| Summary: | [JSC] Bound function optimization is observable with instanceof | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Jan de Mooij <jdemooij> | ||||
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | mark.lam, webkit-bug-importer, ysuzuki | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | Safari Technology Preview | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
Pull request: https://github.com/WebKit/WebKit/pull/11385 |
Created attachment 465371 [details] Test When binding an already-bound function, JSC tries to flatten this chain. This optimization is observable with `instanceof` because it gets the bound function's immediate target and does a `Symbol.hasInstance` lookup on it. See the attached testcase. It should alert 10000 but I get 0 with Safari Technology Preview 165.