Last Comment Bug 782977 - IonMonkey: Fix 3d-raytrace regression
: IonMonkey: Fix 3d-raytrace regression
Status: RESOLVED FIXED
[ion:p1]
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: general
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-08-15 08:40 PDT by Jan de Mooij [:jandem]
Modified: 2012-08-16 01:31 PDT (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (3.50 KB, patch)
2012-08-15 08:40 PDT, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Review

Description Jan de Mooij [:jandem] 2012-08-15 08:40:56 PDT
Created attachment 652117 [details] [diff] [review]
Patch

This came in with the latest m-c merge. The problem is that if a lookup is uncacheable (in this case a missing property on a dense array), but we don't disable the IC, we were still inlining the shape in Ion.

This patch changes things so that we only inline a monomorphic getprop/setprop in Ion if all lookups were cacheable.
Comment 1 Jan de Mooij [:jandem] 2012-08-16 01:31:10 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/53474b3d98aa

Note You need to log in before you can comment on or make changes to this bug.