Open Bug 1008753 Opened 5 years ago Updated 5 years ago

Don't require shape checks when calling getters/setters on common prototypes

Categories

(Core :: JavaScript Engine: JIT, defect)

x86
macOS
defect
Not set

Tracking

()

People

(Reporter: bhackett, Unassigned)

Details

Attachments

(1 file)

Attached patch patchSplinter Review
Right now when Ion optimizes a getter/setter call through the prototype chain a shape guard is required, as TI doesn't have information about the getters or setters on an object.  The attached patch improves this situation, eliminating the shape guards, by using the state change mechanism to invalidate Ion code when a getter/setter property is removed or changed on an object.
Attachment #8420697 - Flags: review?(jdemooij)
Comment on attachment 8420697 [details] [diff] [review]
patch

Lot of reviews today so I'll forward this one to efaust.
Attachment #8420697 - Flags: review?(jdemooij) → review?(efaustbmo)
Comment on attachment 8420697 [details] [diff] [review]
patch

Review of attachment 8420697 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me.

::: js/src/jit/MIR.h
@@ +8441,5 @@
>      }
>  };
>  
>  class MGetDOMProperty
> +  : public MAryInstruction<1>,

Nit: This should maybe go to MUnaryInstruction now? It would be slightly cleaner, while we're here.
Attachment #8420697 - Flags: review?(efaustbmo) → review+
Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/ffa1a2961dd1 - don't ask me how, since b2g test harnesses seem to delight in obscuring the details of failure, but this apparently broke marionette-webapi (https://tbpl.mozilla.org/php/getParsedLog.php?id=39866015&tree=Mozilla-Inbound) and gaia-unit (https://tbpl.mozilla.org/php/getParsedLog.php?id=39865193&tree=Mozilla-Inbound).
You need to log in before you can comment on or make changes to this bug.