1297603 - When guarding on the global's shape in IonBuilder::testCommonGetterSetter, consider guarding on its actual shape

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Boris Zbarsky [:bzbarsky]]

Right now we guard on "globalShape", which comes from the baseline IC.

This can fail to match the actual shape, for example when the getter ends up reshaping the global.  Baseline stores the shape before invoking the getter, which makes sense for objects in general (on the premise that other objects with the pre-getter-reshaped-it shape will come through), but not for the global, imo, because there is the one global.

This is particularly bad because once we fail a shape guard we will deoptimize all shape guards for the script (e.g. mark them not movable)...

Comment 1

[Jan de Mooij [:jandem]]

We just have to make sure that guarding on the current Shape is correct: the Baseline cache info may depend on the global's shape being globalShape. If that's fine we should do this, yeah.

Else we can not perform this optimization if globalShape != global->shape.

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #1)
> Else we can not perform this optimization if globalShape != global->shape.

Sorry this sentence reads weird. I meant s/Else/Alternatively/

Comment 3

[Boris Zbarsky [:bzbarsky]]

To be honest, it's not quite clear to me what's going on here in the testcase I was looking at.  I would have thought that baseline would update the globalshape it stores via the general "we missed the IC, update the shapes" codepath, but apparently that was happening too late or something?

I can try to come up with a minimalish testcase for this if that would be useful.

Comment 4

[André Bargull [:anba]]

No longer valid, IonBuilder has been removed.