[Webkit-unassigned] [Bug 149767] New: We should not add InferredTypeTables to old Structures

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=149767

            Bug ID: 149767
           Summary: We should not add InferredTypeTables to old Structures
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fpizlo at apple.com

If anyone observes that a Structure has no inferred type table, they assume that this means that:

- There are no guarantees about the type of any value loaded from the properties that the Structure knows about.
- It's legal to store any value of any type to any property that the Structure knows about.

If we later add an InferredTypeTable to that structure, we might ascribe a type to a pre-existing property. But there may already be extant objects with that Structure and property, and they may not be using the type that we used. There may also be extant inline caches that are already storing values into that property without any type checks.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151002/b2c63889/attachment.html>