[webkit-reviews] review granted: [Bug 131551] Deleting properties poisons objects : [Attachment 230183] Patch

[bugzilla-daemon at webkit.org]

Oliver Hunt <oliver at apple.com> has granted Mark Hahnenberg
<mhahnenberg at apple.com>'s request for review:
Bug 131551: Deleting properties poisons objects
https://bugs.webkit.org/show_bug.cgi?id=131551

Attachment 230183: Patch
https://bugs.webkit.org/attachment.cgi?id=230183&action=review

------- Additional Comments from Oliver Hunt <oliver at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=230183&action=review


> Source/JavaScriptCore/ChangeLog:15
> +	   (JSC::PropertyTable::hadDeletedOffset): If we ever had deleted
properties we can no longer cache offsets when 
> +	   iterating properties because we're required to iterate properties in
insertion order.

yay javascript!!!

> Source/JavaScriptCore/ChangeLog:21
> +	   (JSC::Structure::removePropertyTransition): We allow up to 5 deletes
for a particular path through the tree of 
> +	   Structure transitions. After that, we convert to an uncacheable
dictionary like we used to. We don't cache 
> +	   delete transitions, but we allow transitioning from them.

how did we choose 5? Is it possible to use 2^n (±1?) so it looks deliberate? :D