Bug 174923

Summary: ScopedArguments overflow storage needs to be in the JSValue gigacage
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: ggaren, jfbastien, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Bug Depends on: 174919    
Bug Blocks: 174917    
Attachments:
Description Flags
the patch saam: review+

Filip Pizlo
Reported 2017-07-27 19:46:22 PDT
...
Attachments
the patch (4.57 KB, patch)
2017-08-11 18:08 PDT, Filip Pizlo 		saam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2017-08-11 18:08:35 PDT
Created attachment 317982 [details] the patch
Saam Barati
Comment 2 2017-08-12 11:13:21 PDT
Comment on attachment 317982 [details] the patch r=me Does polymorphic access also access scoped arguments for “length”?
Filip Pizlo
Comment 3 2017-08-12 11:39:28 PDT
(In reply to Saam Barati from comment #2) > Comment on attachment 317982 [details] > the patch > > r=me > Does polymorphic access also access scoped arguments for “length”? Yeah. Since that's not an indexed access, we don't have to do caging there. We could do it, but then we'd be wagging the dog. The objective here is to make indexed accesses never go outside of a cage. Therefore, we but the object being accessed into a cage. This does not mean that all non-indexed accesses to that object need caging. I don't think that the upside of doing that would be worth the perf.
Filip Pizlo
Comment 4 2017-08-12 11:40:24 PDT
Landed in https://trac.webkit.org/changeset/220624/webkit
Radar WebKit Bug Importer
Comment 5 2017-08-12 11:41:02 PDT
<rdar://problem/33864284>
Saam Barati
Comment 6 2017-08-12 12:07:13 PDT
(In reply to Filip Pizlo from comment #3) > (In reply to Saam Barati from comment #2) > > Comment on attachment 317982 [details] > > the patch > > > > r=me > > Does polymorphic access also access scoped arguments for “length”? > > Yeah. Since that's not an indexed access, we don't have to do caging there. > We could do it, but then we'd be wagging the dog. > > The objective here is to make indexed accesses never go outside of a cage. > > Therefore, we but the object being accessed into a cage. > > This does not mean that all non-indexed accesses to that object need caging. > I don't think that the upside of doing that would be worth the perf. Makes sense. We had this conversation before in a different context, I just forgot :)
Note You need to log in before you can comment on or make changes to this bug.