Because "prototype" lookup is observable.
Created attachment 372377 [details] Patch
Created attachment 372401 [details] Patch
Comment on attachment 372401 [details] Patch Attachment 372401 [details] did not pass jsc-ews (mac): Output: https://webkit-queues.webkit.org/results/12514283 New failing tests: stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-llint stress/create-subclass-structure-might-throw.js.ftl-no-cjit-b3o0 stress/create-subclass-structure-might-throw.js.ftl-no-cjit-small-pool stress/create-subclass-structure-might-throw.js.no-ftl stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-no-put-stack-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-no-inline-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-b3o0 stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.mini-mode stress/create-subclass-structure-might-throw.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-llint stress/create-subclass-structure-might-throw.js.ftl-eager-no-cjit stress/create-subclass-structure-might-throw.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-small-pool stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.default stress/create-subclass-structure-might-throw.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-might-throw.js.default stress/create-subclass-structure-might-throw.js.bytecode-cache stress/create-subclass-structure-might-throw.js.ftl-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.bytecode-cache stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-ftl stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.ftl-eager-no-cjit-b3o1 stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager-no-cjit-b3o1 stress/create-subclass-structure-might-throw.js.ftl-no-cjit-no-inline-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager stress/create-subclass-structure-might-throw.js.mini-mode stress/create-subclass-structure-might-throw.js.ftl-no-cjit-validate-sampling-profiler stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-validate-sampling-profiler stress/create-subclass-structure-might-throw.js.ftl-no-cjit-no-put-stack-validate apiTests
Comment on attachment 372401 [details] Patch Attachment 372401 [details] did not pass jsc-armv7-ews (jsc-only): Output: https://webkit-queues.webkit.org/results/12515198 New failing tests: stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-llint stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.mini-mode stress/create-subclass-structure-might-throw.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.no-llint stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-might-throw.js.mini-mode stress/create-subclass-structure-might-throw.js.no-cjit-collect-continuously stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.default stress/create-subclass-structure-might-throw.js.default stress/create-subclass-structure-might-throw.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.dfg-maximal-flush-validate-no-cjit apiTests
Created attachment 372443 [details] Patch Adjust tests.
Comment on attachment 372443 [details] Patch Nice! You seem to be really good at finding this "slightly-off" cases. :D
Comment on attachment 372443 [details] Patch Clearing flags on attachment: 372443 Committed r248787: <https://trac.webkit.org/changeset/248787>
All reviewed patches have been landed. Closing bug.
<rdar://problem/54404112>