584565 - TM: when f.length is resolved at record time, we can fail to emit a shape guard

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

Luke found this test case:

var x = 0, y = 0, f;
for (var i = 0; i < 100; i++) {
    f = function() {};
    f.foo;
    x + f.length;
}

When recording f.length, we trigger a resolve hook which changes f's shape without calling forgetGuardedShapesForObject, which is necessary to invalidate the guardedShapeTable entry for f.

The straightforward fix is to add another call to forgetGuardedShapesForObject in each place where a shape changes that can be reached at record time.

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

Here is, probably, the shortest possible fix. It means emitting less-than-ideal code, but this case is rare to begin with.

(I tried narrowly checking aobj's shape before and after the lookup, and it fixed the test case at hand, but I was unable to convince myself that was correct. The lookup could change the shapes of other objects.)

Comment 2

[Jason Orendorff [:jorendorff]]

No difference on SunSpider or V8.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 463173 [details] [diff] [review]
v1

Worth commenting with a "FIXME: bug 458271" comment?

/be

Comment 4

[Jason Orendorff [:jorendorff]]

FIXME comment added.

http://hg.mozilla.org/tracemonkey/rev/324b0d7b7ded

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/324b0d7b7ded