562793 - JM: PICs need to handle disabled property cache

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

The property cache can get disabled if we run out of shapes, which the PICs don't currently check for. I think bug 558451 would fix this problem, if it also allowed us to guard on scope/proptreenode pointers instead of shape numbers.

Alternatively, if we do have to handle this case directly, it seems like we should not create PIC stubs if the property cache is disabled. I think we also need to purge all PICs (which we do already on GC, so it is not hard) when the property cache becomes disabled.

Comment 1

[Brendan Eich [:brendan]]

Bug 558451 kept 32-bit (24-bit, really) shape identifiers. This bug should not block on that bug. If we want to use js::Shape pointers, we need a new bug (or just use this one), but it isn't clearly worth it.

The generation number approach lets us avoid allocation Shapes unpredictably and it is as fast to load the shape id from the object now, as it is to get the Shape pointer from the object.

More analysis needed, but what needs to happen in JM if we stick with shape ids instead of pointers?

/be

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

I think the solution in comment #0 works - the ICs should check and not generate stubs, and we should purge ICs at the overflow.

Comment 3

[Luke Wagner [:luke]]

JM removed.