Open Bug 1008753 Opened 5 years ago Updated 5 years ago

Don't require shape checks when calling getters/setters on common prototypes


(Core :: JavaScript Engine: JIT, defect)

Not set




(Reporter: bhackett, Unassigned)



(1 file)

Attached patch patchSplinter Review
Right now when Ion optimizes a getter/setter call through the prototype chain a shape guard is required, as TI doesn't have information about the getters or setters on an object.  The attached patch improves this situation, eliminating the shape guards, by using the state change mechanism to invalidate Ion code when a getter/setter property is removed or changed on an object.
Attachment #8420697 - Flags: review?(jdemooij)
Comment on attachment 8420697 [details] [diff] [review]

Lot of reviews today so I'll forward this one to efaust.
Attachment #8420697 - Flags: review?(jdemooij) → review?(efaustbmo)
Comment on attachment 8420697 [details] [diff] [review]

Review of attachment 8420697 [details] [diff] [review]:

Looks good to me.

::: js/src/jit/MIR.h
@@ +8441,5 @@
>      }
>  };
>  class MGetDOMProperty
> +  : public MAryInstruction<1>,

Nit: This should maybe go to MUnaryInstruction now? It would be slightly cleaner, while we're here.
Attachment #8420697 - Flags: review?(efaustbmo) → review+
Backed out in - don't ask me how, since b2g test harnesses seem to delight in obscuring the details of failure, but this apparently broke marionette-webapi ( and gaia-unit (
You need to log in before you can comment on or make changes to this bug.