Bug 31198 - Can cache prototype lookups on uncacheable dictionaries.
Summary: Can cache prototype lookups on uncacheable dictionaries.
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2009-11-05 22:38 PST by Oliver Hunt
Modified: 2009-11-09 19:31 PST (History)
3 users (show)

See Also:

Patch (13.68 KB, patch)
2009-11-09 17:43 PST, Oliver Hunt
no flags Details | Formatted Diff | Diff
Fix wrong expectation (1.12 KB, patch)
2009-11-09 19:25 PST, Shinichiro Hamaji
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2009-11-05 22:38:12 PST
var o = {a:5,b:6}; var a={__proto__:o}; delete o.b; function f(o) {return o.a; }; f(a); f(a);f(a); delete o.a; o.c="FAIL"; alert(f(a));
Comment 1 Oliver Hunt 2009-11-09 17:43:35 PST
Created attachment 42816 [details]
Comment 2 Gavin Barraclough 2009-11-09 18:07:43 PST
Comment on attachment 42816 [details]

I don't like the name sortedProperties, partly because in the first loop, it isn't yet sorted, partly because it was not immediately clear to me these were pointers into the original map (modified by the entry-> writes).

I'm not sure what a good name would be, so I think a couple more comments (like, "These writes are modifying the persistent property map for the structure!".  Or something.)

And the variable name 'p' is kinda sucky, too.

But the code all looks sensible, r+.
Comment 3 Oliver Hunt 2009-11-09 18:20:09 PST
Committed r50704
Comment 4 Shinichiro Hamaji 2009-11-09 19:25:14 PST
Created attachment 42842 [details]
Fix wrong expectation
Comment 5 Oliver Hunt 2009-11-09 19:26:30 PST
Comment on attachment 42842 [details]
Fix wrong expectation


whoops :-(
Comment 6 Oliver Hunt 2009-11-09 19:31:14 PST
Comment on attachment 42842 [details]
Fix wrong expectation

I guess the commit bot won't land build fixes. weee!