If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

JSOP_INCNAME and its ilk seem to always miss prop cache when incrementing global in this testcase

NEW
Unassigned

Status

()

Core
JavaScript Engine
8 years ago
3 years ago

People

(Reporter: bz, Unassigned)

Tracking

(Blocks: 1 bug, {perf})

Trunk
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

STEPS TO REPRODUCE:

1)  Breakpoint in the JSOP_INCNAME/DECNAME/etc case in jsops.cpp
2)  Load attached testcase.
3)  Step down to right after the ASSERT_VALID_PROPERTY_CACHE_HIT when trying
    to increment |x|.
4)  Observe that PCVAL_IS_SLOT(entry) is false.
5)  See that we call js_FindPropertyHelper as a result.
6)  Note that this happens every time we try to increment x.

I can understand not being able to take the fast-increment path if the entry is not a slot (though not why it's not a slot in this case, honestly).  But do we really have to call js_FindPropertyHelper?
Created attachment 401368 [details]
Testcase
(Assignee)

Updated

3 years ago
Assignee: general → nobody
You need to log in before you can comment on or make changes to this bug.