503406 - TM: Trace calling a user-attached function to RegExp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[David Mandelin [:dmandelin]]

Attachment: Test case

The attached test case doesn't trace. Output:

foo
foo
abort: 11653: callee is not an object
Abort recording of tree /tmp/callprop.js:6@34 at /tmp/callprop.js:7@38: callprop.
foo
foo
foo

It *does* trace if I attach the function to Object.prototype instead. It may have something to do with specialness of the RegExp prototype, but I don't know. What is clear is that the result of test_property_cache is not an object (presumably it is a property or slot instead), and the tracer doesn't support that yet.

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

This is a patch against m-c. I'm gonna disown the bug if I can't check in there.

/be

Comment 3

[Robert Sayre]

looks ok to take on m-c to me

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 387755 [details] [diff] [review]
fix

want-getters-and-setters!

Comment 5

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/49fed67a8067
http://hg.mozilla.org/mozilla-central/rev/a94b39c8f546

/be

Comment 6

[Boris Zbarsky [:bzbarsky]]

Could this have caused the 3.23% Dromaeo regression pointed to here: http://groups.google.com/group/mozilla.dev.tree-management/msg/7344f39035b7a9f7 ?

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/49fed67a8067

Comment 8

[Brendan Eich [:brendan]]

(In reply to comment #6)
> Could this have caused the 3.23% Dromaeo regression pointed to here:
> http://groups.google.com/group/mozilla.dev.tree-management/msg/7344f39035b7a9f7
> ?

Jorendorff had some experience with Dromaeo noise jumps lately. I don't see how the patch could slow anything down. What's the chart like since then?

/be