Bug 177523 – Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

This will make it wrong. However, the reason I think it's correct just by the skin of its teeth today because we'll end up always flattening all structures in the prototype chain. Looking at normalizePrototypeChain, things might break with a JSProxy in the prototype chain.

The reason things barely work today is I think that "hasBeenFlattenedBefore()" will always return false when you're a dictionary. The reason being, when we create a structure via its transition constructor, we don't propagate forward the "hasBeenFlattenedBefore" bit. The only way to make a dictionary structure is via a transition, hence, it'll never have that bit set. So, every time we ask a dictionary structure "hasBeenFlattenedBefore", it'll say no.

[Saam Barati]

I'm testing this hypothesis now by running all JSC stress tests with a CRASH() if hasBeenFlattenedBefore() ever returns true.

[Saam Barati]

Created attachment 321996 [details]
patch

[Saam Barati]

I'm going to run benchmarks before landing

[Mark Lam]

Comment on attachment 321996 [details]
patch

r=me

[Saam Barati]

Created attachment 322027 [details]
perf results

Neutral or perhaps 0.5% progressed.

[WebKit Commit Bot]

Comment on attachment 321996 [details]
patch

Clearing flags on attachment: 321996

Committed r222590: <http://trac.webkit.org/changeset/222590>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/34702967>