Closed Bug 920689 Opened 6 years ago Closed 6 years ago

Don't represent types inherited from prototypes in type sets

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla27

People

(Reporter: bhackett, Assigned: bhackett)

References

Details

Attachments

(1 file)

Attached patch patchSplinter Review
TI has a longstanding behavior of putting types in property type sets that reflect both 'own' properties on the object and properties along the prototype chain.  This was done for more efficient generation of constraints in analyzeTypes, but the need for that is gone and there are only a few places in IonBuilder where we need to scan the prototype chain for property types.  This walking can be done manually instead of propagating types downwards.  Making this change both allows considerable simplification of some of TI's data structures and APIs, and is necessary for being able to run IonBuilder off thread --- currently heap property type sets can be modified by IonBuilder when adding subset constraints between them.
Attachment #810064 - Flags: review?(jdemooij)
Comment on attachment 810064 [details] [diff] [review]
patch

Review of attachment 810064 [details] [diff] [review]:
-----------------------------------------------------------------

I've seen (performance) problems caused by TestSingletonProperty for things like (4).toString: toString's TypeSet contained both Number.prototype.toString and Object.prototype.toString. This patch should fix that because TestSingletonProperty walks only up to the holder right? If so that's really nice.

::: js/src/jsinfer.h
@@ +461,5 @@
>          JS_ASSERT((flags & TYPE_FLAG_BASE_MASK) == flags);
>          return !!(baseFlags() & flags);
>      }
>  
> +    bool configuredProperty() const {

Great to see "bool ownProperty(bool configurable)" gone, that always confused me.
Attachment #810064 - Flags: review?(jdemooij) → review+
CC'ing some people to make sure they are aware of this change.
https://hg.mozilla.org/mozilla-central/rev/3f8e57e07eee
Assignee: nobody → bhackett1024
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
Depends on: 932875
Depends on: 1028990
You need to log in before you can comment on or make changes to this bug.