Closed
Bug 920689
Opened 8 years ago
Closed 8 years ago
Don't represent types inherited from prototypes in type sets
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla27
People
(Reporter: bhackett1024, Assigned: bhackett1024)
References
Details
Attachments
(1 file)
68.61 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
TI has a longstanding behavior of putting types in property type sets that reflect both 'own' properties on the object and properties along the prototype chain. This was done for more efficient generation of constraints in analyzeTypes, but the need for that is gone and there are only a few places in IonBuilder where we need to scan the prototype chain for property types. This walking can be done manually instead of propagating types downwards. Making this change both allows considerable simplification of some of TI's data structures and APIs, and is necessary for being able to run IonBuilder off thread --- currently heap property type sets can be modified by IonBuilder when adding subset constraints between them.
Attachment #810064 -
Flags: review?(jdemooij)
Comment 1•8 years ago
|
||
Comment on attachment 810064 [details] [diff] [review] patch Review of attachment 810064 [details] [diff] [review]: ----------------------------------------------------------------- I've seen (performance) problems caused by TestSingletonProperty for things like (4).toString: toString's TypeSet contained both Number.prototype.toString and Object.prototype.toString. This patch should fix that because TestSingletonProperty walks only up to the holder right? If so that's really nice. ::: js/src/jsinfer.h @@ +461,5 @@ > JS_ASSERT((flags & TYPE_FLAG_BASE_MASK) == flags); > return !!(baseFlags() & flags); > } > > + bool configuredProperty() const { Great to see "bool ownProperty(bool configurable)" gone, that always confused me.
Attachment #810064 -
Flags: review?(jdemooij) → review+
Comment 2•8 years ago
|
||
CC'ing some people to make sure they are aware of this change.
Assignee | ||
Comment 3•8 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/3f8e57e07eee
https://hg.mozilla.org/mozilla-central/rev/3f8e57e07eee
Assignee: nobody → bhackett1024
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in
before you can comment on or make changes to this bug.
Description
•