1351388 - InIRGenerator::tryAttachNativeIn should handle non-data properties

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement)

Description

[Tom S [:evilpie]]

This method currently checks IsCacheableGetPropReadSlotForIonOrCacheIR, but that is too restrictive. This will fail for getters and also for Array#length, which is a special kind of getter.

I think we can just not call IsCacheableGetPropReadSlotForIonOrCacheIR, but maybe there is something weird I am forgetting.

Comment 1

[Ted Campbell [:tcampbell]]

Looks reasonable. The cacheable check is covered by LookupPropertyPure checking for a static-prototype chain until the holder. We do need to check for prop.found() still.

Good catch.

Comment 2

[Ted Campbell [:tcampbell]]

Attachment: Bug 1351388 - Allow non-data properties in InIRGenerator::tryAttachNativeIn

Review commit: https://reviewboard.mozilla.org/r/124352/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/124352/

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8852142 [details]
Bug 1351388 - Allow non-data properties in InIRGenerator::tryAttachNativeIn

https://reviewboard.mozilla.org/r/124352/#review127136

Nice find.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dc3e129f4433
Allow non-data properties in InIRGenerator::tryAttachNativeIn r=jandem

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/dc3e129f4433