474888 - TM: Incorrect use of the global object's identity

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Comment 1

[Andreas Gal :gal]

Attachment: patch

Comment 2

[Andreas Gal :gal]

Trees are only executed if the shape of the global object has not changed since recording time. We do not actually guarantee that the global object's identity is unchanged. We only guarantee the shape still matches. In the actual trace code we used the global object's identity to decide whether it aliases an object being used for direct property access. This might be wrong if we get a different global object with the same shape. Instead, this patch passes in the current global object's identity via InterpState. No measurable perf overhead. The patch also fixes an incorrect use of cx->globalObject in the oracle hashing and excludes the global object's identity from the hash (for the argument made above, we only care about the shape).

Comment 3

[Andreas Gal :gal]

TM: http://hg.mozilla.org/tracemonkey/rev/29beb0928cfa

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/29beb0928cfa

Comment 5

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/b244bae60086