What we do now invalidates our caching policies. For example, arrow functions and normal vanilla sloppy functions share a structure. If we do: ``` function foo() { } let bar = () => undefined; bar.hasOwnProperty("prototype"); // false. This is expected foo.hasOwnProperty("prototype"); // false. This is wrong! ``` This is probably broken in get ICs as well. The bug is we either can't cache this property, or we need different structures to represent the difference in type here.
Here is an example of get being broken: ``` function assert(b) { if (!b) throw new Error; } function foo(f) { return f.prototype; } { let f1 = function () { }; let f2 = () => undefined; for (let i = 0; i < 100; ++i) assert(foo(f2) === undefined); assert(foo(f1) !== undefined); } ``` I think JF recently fixed a similar issue w/ strict vs sloppy mode functions.
<rdar://problem/35814591>
<rdar://problem/36035267>
Created attachment 329298 [details] patch
Comment on attachment 329298 [details] patch r=me
Comment on attachment 329298 [details] patch Clearing flags on attachment: 329298 Committed r225891: <https://trac.webkit.org/changeset/225891>
All reviewed patches have been landed. Closing bug.
Comment on attachment 329298 [details] patch Belated r=me too