| Summary: | [JSC] __proto__ produces incorrect value after Object.prototype.__proto__ changes | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | YuHao Hu <q602706150> |
| Component: | JavaScriptCore | Assignee: | Alexey Shvayka <ashvayka> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | ashvayka, mark.lam, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Pull request: https://github.com/WebKit/WebKit/pull/15247 Committed 265594@main (667a7374f1dd): <https://commits.webkit.org/265594@main> Reviewed commits have been landed. Closing PR #15247 and removing active labels. |
WebKit git commit: fa67a26252252fec5d3f124b05398ce812cfdffc run args: ./jsc --useConcurrentJIT=0 --jitPolicyScale=0.1 test.js ``` function opt(){ return Uint8Array.__proto__ } noDFG(opt) function test() { for(let i=0;i<100;i++) opt() Object.defineProperty(Object.prototype, "__proto__", { "get": function () { return "xxx" } }) print(opt() == Uint8Array.__proto__) } noDFG(test) test() ``` The test case should print `true`, however it prints `false`. Is this a bug about InlineCache?