Created attachment 387746 [details] Test case The attached test case doesn't trace. Output: foo foo abort: 11653: callee is not an object Abort recording of tree /tmp/callprop.js:6@34 at /tmp/callprop.js:7@38: callprop. foo foo foo It *does* trace if I attach the function to Object.prototype instead. It may have something to do with specialness of the RegExp prototype, but I don't know. What is clear is that the result of test_property_cache is not an object (presumably it is a property or slot instead), and the tracer doesn't support that yet.
Created attachment 387755 [details] [diff] [review] fix
This is a patch against m-c. I'm gonna disown the bug if I can't check in there. /be
looks ok to take on m-c to me
Comment on attachment 387755 [details] [diff] [review] fix want-getters-and-setters!
http://hg.mozilla.org/tracemonkey/rev/49fed67a8067 http://hg.mozilla.org/mozilla-central/rev/a94b39c8f546 /be
Could this have caused the 3.23% Dromaeo regression pointed to here: http://groups.google.com/group/mozilla.dev.tree-management/msg/7344f39035b7a9f7 ?
(In reply to comment #6) > Could this have caused the 3.23% Dromaeo regression pointed to here: > http://groups.google.com/group/mozilla.dev.tree-management/msg/7344f39035b7a9f7 > ? Jorendorff had some experience with Dromaeo noise jumps lately. I don't see how the patch could slow anything down. What's the chart like since then? /be