803278 - Ion set IC does a terrible job with readonly non-own properties

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

I was looking at a profile in bug 802157 and discovered that with ion we're spending a ton of time under ion::SetPropertyCache.  The reason for that is that the testcase does an assignment like so:

  foo.bar = something;

where "bar" is a readonly accessor prop (so has a getter, but no setter provided) on foo.__proto__ in this case.  But SetPropertyCache only caches own properties with slots, so we keep missing the cache over and over.

Seems like this specific case (non-strict mode, set of readonly prop) should be pretty easy to cache... it's a no-op.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Yeah, this should be pretty straightforward - I think just a shape guard and jump back to the inline path.

Comment 2

[Mayank Bansal]

Nightly:
5154639.175257732
1934235.9767891683
2262443.438914027

Chrome:
2777777.777777778
1388888.888888889
1557632.398753894