<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - We should not add InferredTypeTables to old Structures"
href="https://bugs.webkit.org/show_bug.cgi?id=149767">149767</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>We should not add InferredTypeTables to old Structures
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>fpizlo@apple.com
</td>
</tr></table>
<p>
<div>
<pre>If anyone observes that a Structure has no inferred type table, they assume that this means that:
- There are no guarantees about the type of any value loaded from the properties that the Structure knows about.
- It's legal to store any value of any type to any property that the Structure knows about.
If we later add an InferredTypeTable to that structure, we might ascribe a type to a pre-existing property. But there may already be extant objects with that Structure and property, and they may not be using the type that we used. There may also be extant inline caches that are already storing values into that property without any type checks.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>