You might also like JSGlobalObject::haveABadTime() https://github.com/WebKit/WebKit/blob/b305f64a67e288b714a84ff40b0a66d4fa3a3f6c/Source/JavaScriptCore/runtime

You might also like JSGlobalObject::haveABadTime() https://github.com/WebKit/WebKit/blob/b305f64a67e288b714a84ff40b0a66d4fa3a3f6c/Source/JavaScriptCore/runtime/JSGlobalObject.cpp#L2178 https://github.com/WebKit/WebKit/blob/b305f64a67e288b714a84f... // Consider the following objects and prototype chains: // O (of global G1) -> A (of global G1) // B (of global G2) where G2 has a bad time // // If we set B as the prototype of A, G1 will need to have a bad time. // See comments in Structure::mayInterceptIndexedAccesses() for why. // // Now, consider the following objects and prototype chains: // O1 (of global G1) -> A1 (of global G1) -> B1 (of global G2) // O2 (of global G2) -> A2 (of global G2) // B2 (of global G3) where G3 has a bad time. // // G1 and G2 does not have a bad time, but G3 already has a bad time. // If we set B2 as the prototype of A2, then G2 needs to have a bad time. // Note that by induction, G1 also now needs to have a bad time because of // O1 -> A1 -> B1. // // We describe this as global G1 being affected by global G2, and G2 by G3. // Similarly, we say that G1 is dependent on G2, and G2 on G3. // Hence, when G3 has a bad time, we need to ensure that all globals that // are transitively dependent on it also have a bad time (G2 and G1 in this // example). // // Apart from clearing the VM structure cache above, there are 2 more things // that we have to do when globals have a bad time: // 1. For each affected global: // a. Fire its HaveABadTime watchpoint. // b. Convert all of its array structures to SlowPutArrayStorage. // 2. Make sure that all affected objects switch to the slow kind of // indexed storage. An object is considered to be affected if it has // indexed storage and has a prototype object which may have indexed // accessors. If the prototype object belongs to a global having a bad // time, then the prototype object is considered to possibly have indexed // accessors. See comments in Structure::mayInterceptIndexedAccesses() // for details. // // Note: step 1 must be completed before step 2 because step 2 relies on // the HaveABadTime watchpoint having already been fired on all affected // globals. // // In the common case, only this global will start having a bad time here, // and no other globals are affected by it. So, we first proceed on this assumption // with a simpler ObjectsWithBrokenIndexingFinder scan to find heap objects // affected by this global that need to be converted to SlowPutArrayStorage. // We'll also have the finder check for the presence of other global objects // depending on this one. // // If we do discover other globals depending on this one, we'll abort this // first ObjectsWithBrokenIndexingFinder scan because it will be insufficient // to find all affected objects that need to be converted to SlowPutArrayStorage. // It also does not make dependent globals have a bad time. Instead, we'll // take a more comprehensive approach of first creating a dependency graph // between globals, and then using that graph to determine all affected // globals and objects. With that, we can make all affected globals have a // bad time, and convert all affected objects to SlowPutArrayStorage.