516864 - Quickstubbed DOM setters no longer stay on trace unless the DOM object is exactly the same

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

See attached testcase.  When I run it, I get jitstats looking something like this:

recorder: started(1), aborted(0), completed(33), different header(0), trees trashed(1), slot promoted(0), unstable loop variable(0), breaks(0), returns(0), unstableInnerCalls(0), blacklisted(0)
monitor: triggered(197), exits(197), type mismatch(0), global mismatch(0)

So we compile traces out to MAX_BRANCHES, then give up.  Each time through the loop we're branch-exiting on the className set.

I tried doing a quick log of that, but there seem to be at least 3 separate guards all claiming the same lr= (kshape, vshape, proto, looks like).  Clearly those divs are ending up with different shapes _somehow_.  This didn't use to be the case.  Given what I ran into in bug 516857, this is possibly a regression from bug 503080.  That doesn't look like it's on any branches yet, so not nominating for anything so far.

Comment 1

[Boris Zbarsky [:bzbarsky]]

It looks like this is actually a regression from bug 505523 (so much more recent than we thought last night).

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Looks like this works for me now (probably because of the second patch in bug 505523).