Butterfly

Butterfly

Immutable Pointer

When an array is initialized and not changed in following code. It will have an immutable pointer and keep CopyOnWriteArray.

When it is changed, however, the butterfly pointer will be changed to another address(from immutable to mutable now). And the structure ID will also needed to change. A demo:

a = [1,2,3]

debug(describe(a))
print()

function show(arr) {
    return a[0]
}

for(i = 0; i < 0x1000; i++) {
    show(a)
}

debug(describe(a))
print()

a[0] = 0
debug(describe(a))
print()

And the phase is changed:

--> Object: 0x7fffaf6b4350 with butterfly 0x7ff0000e0010 (Structure 0x7fffaf6f2c30:[Array, {}, CopyOnWriteArrayWithInt32, Proto:0x7fffaf6c8080, Leaf]), StructureID: 102
gef➤  x/10gx  0x7fffaf6b4350
0x7fffaf6b4350: 0x0108211500000066 0x00007ff0000e0010
gef➤  x/10gx 0x00007ff0000e0010
0x7ff0000e0010: 0xffff000000000001 0xffff000000000002
0x7ff0000e0020: 0xffff000000000003 0x00000000badbeef0

--> Object: 0x7fffaf6b4350 with butterfly 0x7ff0000e0010 (Structure 0x7fffaf6f2c30:[Array, {}, CopyOnWriteArrayWithInt32, Proto:0x7fffaf6c8080, Leaf]), StructureID: 102
gef➤  x/10gx 0x7fffaf6b4350
0x7fffaf6b4350: 0x0108211500000066 0x00007ff0000e0010
gef➤  x/10gx 0x00007ff0000e0010
0x7ff0000e0010: 0xffff000000000001 0xffff000000000002
0x7ff0000e0020: 0xffff000000000003 0x00000000badbeef0

--> Object: 0x7fffaf6b4350 with butterfly 0x7ff0000f8488 (Structure 0x7fffaf6f2a00:[Array, {}, ArrayWithInt32, Proto:0x7fffaf6c8080, Leaf]), StructureID: 97
gef➤  x/10gx 0x7fffaf6b4350
0x7fffaf6b4350: 0x0108210500000061 0x00007ff0000f8488
gef➤  x/10gx 0x00007ff0000f8488
0x7ff0000f8488: 0xffff000000000000 0xffff000000000002
0x7ff0000f8498: 0xffff000000000003 0x00000000badbeef0