Bug 180779 – Arrow functions need their own structure because they have different properties than sloppy functions

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

What we do now invalidates our caching policies. For example, arrow functions and normal vanilla sloppy functions share a structure.
If we do:
```
function foo() { }
let bar = () => undefined;

bar.hasOwnProperty("prototype"); // false. This is expected
foo.hasOwnProperty("prototype"); // false. This is wrong!
```

This is probably broken in get ICs as well. The bug is we either can't cache this property, or we need different structures to represent the difference in type here.

[Saam Barati]

Here is an example of get being broken:

```
function assert(b) {
    if (!b)
        throw new Error;
}

function foo(f) {
    return f.prototype;
}

{
    let f1 = function () { };
    let f2 = () => undefined;
    for (let i = 0; i < 100; ++i)
        assert(foo(f2) === undefined);
    assert(foo(f1) !== undefined);
}
```

I think JF recently fixed a similar issue w/ strict vs sloppy mode functions.

[Saam Barati]

<rdar://problem/35814591>

[Radar WebKit Bug Importer]

<rdar://problem/36035267>

[Saam Barati]

Created attachment 329298 [details]
patch

[Mark Lam]

Comment on attachment 329298 [details]
patch

r=me

[WebKit Commit Bot]

Comment on attachment 329298 [details]
patch

Clearing flags on attachment: 329298

Committed r225891: <https://trac.webkit.org/changeset/225891>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[JF Bastien]

Comment on attachment 329298 [details]
patch

Belated r=me too