Open
Bug 1437103
Opened 7 years ago
Updated 2 years ago
[Meta] Spectre mitigations for object type checks
Categories
(Core :: JavaScript Engine: JIT, enhancement, P3)
Core
JavaScript Engine: JIT
Tracking
()
NEW
| Tracking | Status | |
|---|---|---|
| firefox60 | --- | affected |
People
(Reporter: jandem, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: meta)
This includes:
* Ion object type barriers
* Ion shape/group/class guards
* Shape/group/class guards on the holder object in GetProp/GetName/GetElem ICs
We should have separate bugs for each of these.
|
||
Updated•7 years ago
|
status-firefox60:
--- → affected
Priority: -- → P1
|
||
Comment 1•6 years ago
|
||
Moving to p3 because no activity for at least 24 weeks.
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information
Priority: P1 → P3
|
||
Updated•2 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•