[Webkit-unassigned] [Bug 95073] WindowShell and global registers break IC

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=95073





--- Comment #5 from Geoffrey Garen <ggaren at apple.com>  2012-08-27 20:30:35 PST ---
Our typical defense against this type of bug is that the function doing the lookup and caching checks that the property owner (PropertySlot::slotBase()) is equal to the object on which it's doing the lookup, and refuses to cache if not. 

Do you know what goes wrong with that defense in this case?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.