[Webkit-unassigned] [Bug 144465] New: Object allocation not sinking properly through CheckStructure

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu Apr 30 12:23:48 PDT 2015


https://bugs.webkit.org/show_bug.cgi?id=144465

            Bug ID: 144465
           Summary: Object allocation not sinking properly through
                    CheckStructure
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: basile_clement at apple.com

Created attachment 252079
  --> https://bugs.webkit.org/attachment.cgi?id=252079&action=review
Example of the bug

When sinking allocations through CheckStructure node, we are just ignoring them, which may cause code that should have been guarded by the CheckStructure to execute unchecked and produce wrong results.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150430/7128a477/attachment.html>


More information about the webkit-unassigned mailing list