562349 - TM: Fall back on slow paths in TraceRecorder::setProperty

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

These cases cause us to stop recording:

 - obj or a prototype is non-native
 - obj or a prototype has a resolve hook
 - obj or a prototype is shared among contexts
 - we're adding a new property, and obj has a JSClass::addProperty hook
 - the property being set has a setter and a slot

More subtly, adding a property to a dictionary scope traces OK, but we'll most likely flunk the shape guard when we actually try to execute the trace.

TR::initOrSetPropertyByName stands ready to emit a slow path for all these cases.

Comment 1

[Brendan Eich [:brendan]]

Dictionary-mode scopes are often for singleton objects, e.g. jresig's UUID based DOM node table to work around leaks in IE. So we need to measure where the lack of predicatble shapes among > 1 objects in dictionary mode bite us.

JSC works the same here AFAICT.

/be

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.