[webkit-reviews] review denied: [Bug 97530] Regression, freeze applied to numeric properties of non-array objects : [Attachment 165530] Fix

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Gavin Barraclough
<barraclough at apple.com>'s request for review:
Bug 97530: Regression, freeze applied to numeric properties of non-array
objects
https://bugs.webkit.org/show_bug.cgi?id=97530

Attachment 165530: Fix
https://bugs.webkit.org/attachment.cgi?id=165530&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=165530&action=review


> Source/JavaScriptCore/runtime/ObjectConstructor.cpp:407
> +    if (isJSFinalObject(object) && !object->getVectorLength()) {

What if the object has gone into sparse mode?  Then vector length will be zero
even though there are indexed properties.

I think what you wanted is:

hasIndexedProperties(object->structure()->indexingType())