481246 - Guard that we don't have to re-brand when writing a function into a slot

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jeff Walden [:Waldo]]

The fix for bug 473256 isn't quite enough, because it allows shape unsyncing between JIT and interpreter and penalizes global sets rather than global calls, which might be the wrong way to split the baby.

Comment 1

[Andreas Gal :gal]

Attachment: patch

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 365286 [details] [diff] [review]
patch

FIXME: comment citing a new bug asking for function to be split from object trace-type, and r=me.

/be

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 365286 [details] [diff] [review]
patch

>+                /*
>+                 * If we are recording a function being set into the slot, we must write the
>+                 * same function thats already in the slot, otherwise we would have to re-brand.

that's

>+                /*
>+                 * If a regular object was written, we have to guard that its not a function

it's

Comment 4

[Andreas Gal :gal]

Attachment: with nits

Comment 5

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/122cf18c1b7d

Comment 6

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/1c16405d7d6c
/cvsroot/mozilla/js/tests/js1_8_1/trace/trace-test.js,v  <--  trace-test.js
new revision: 1.12; previous revision: 1.11

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/122cf18c1b7d

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/6ae4b96e23bf

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2