Last Comment Bug 782977 - IonMonkey: Fix 3d-raytrace regression
: IonMonkey: Fix 3d-raytrace regression
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: general
: Jason Orendorff [:jorendorff]
Depends on:
  Show dependency treegraph
Reported: 2012-08-15 08:40 PDT by Jan de Mooij [:jandem]
Modified: 2012-08-16 01:31 PDT (History)
1 user (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (3.50 KB, patch)
2012-08-15 08:40 PDT, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Splinter Review

Description User image Jan de Mooij [:jandem] 2012-08-15 08:40:56 PDT
Created attachment 652117 [details] [diff] [review]

This came in with the latest m-c merge. The problem is that if a lookup is uncacheable (in this case a missing property on a dense array), but we don't disable the IC, we were still inlining the shape in Ion.

This patch changes things so that we only inline a monomorphic getprop/setprop in Ion if all lookups were cacheable.
Comment 1 User image Jan de Mooij [:jandem] 2012-08-16 01:31:10 PDT

Note You need to log in before you can comment on or make changes to this bug.