920689 - Don't represent types inherited from prototypes in type sets

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett (:bhackett)]

Attachment: patch

TI has a longstanding behavior of putting types in property type sets that reflect both 'own' properties on the object and properties along the prototype chain.  This was done for more efficient generation of constraints in analyzeTypes, but the need for that is gone and there are only a few places in IonBuilder where we need to scan the prototype chain for property types.  This walking can be done manually instead of propagating types downwards.  Making this change both allows considerable simplification of some of TI's data structures and APIs, and is necessary for being able to run IonBuilder off thread --- currently heap property type sets can be modified by IonBuilder when adding subset constraints between them.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 810064 [details] [diff] [review]
patch

Review of attachment 810064 [details] [diff] [review]:
-----------------------------------------------------------------

I've seen (performance) problems caused by TestSingletonProperty for things like (4).toString: toString's TypeSet contained both Number.prototype.toString and Object.prototype.toString. This patch should fix that because TestSingletonProperty walks only up to the holder right? If so that's really nice.

::: js/src/jsinfer.h
@@ +461,5 @@
>          JS_ASSERT((flags & TYPE_FLAG_BASE_MASK) == flags);
>          return !!(baseFlags() & flags);
>      }
>  
> +    bool configuredProperty() const {

Great to see "bool ownProperty(bool configurable)" gone, that always confused me.

Comment 2

[Jan de Mooij [:jandem]]

CC'ing some people to make sure they are aware of this change.

Comment 3

[Brian Hackett (:bhackett)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3f8e57e07eee

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3f8e57e07eee