<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - DFG::safeToExecute() is wrong for MultiGetByOffset, doesn't consider the structures of the prototypes that get loaded from"
href="https://bugs.webkit.org/show_bug.cgi?id=147250#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - DFG::safeToExecute() is wrong for MultiGetByOffset, doesn't consider the structures of the prototypes that get loaded from"
href="https://bugs.webkit.org/show_bug.cgi?id=147250">bug 147250</a>
from <span class="vcard"><a class="email" href="mailto:fpizlo@apple.com" title="Filip Pizlo <fpizlo@apple.com>"> <span class="fn">Filip Pizlo</span></a>
</span></b>
<pre>It just occurred to me that there's a tremendously simple solution: don't use MultiGetByOffset for prototype loads if the field in the prototype isn't constant-inferred. That means we don't have to do any kind of checks on the prototype to guarantee the safety of MultiGetByOffset's execution.
Another solution is to prevent hoisting of MutliGetByOffset's whose prototype properties are not constant-inferred.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>