[Webkit-unassigned] [Bug 144465] New: Object allocation not sinking properly through CheckStructure
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Apr 30 12:23:48 PDT 2015
https://bugs.webkit.org/show_bug.cgi?id=144465
Bug ID: 144465
Summary: Object allocation not sinking properly through
CheckStructure
Classification: Unclassified
Product: WebKit
Version: 528+ (Nightly build)
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: basile_clement at apple.com
Created attachment 252079
--> https://bugs.webkit.org/attachment.cgi?id=252079&action=review
Example of the bug
When sinking allocations through CheckStructure node, we are just ignoring them, which may cause code that should have been guarded by the CheckStructure to execute unchecked and produce wrong results.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150430/7128a477/attachment.html>
More information about the webkit-unassigned
mailing list