property cache tracing doubts

[Jim Blandy]

(Warning: I haven't actually put together a test program to verify
that everything here happens as I claim, but it's late, so I'll do
that tomorrow and just post this now for folks' amusement.)

Let A:B mean that B is A's proto.
Let A->B mean B is A's parent.

Suppose I'm evaluating JavaScript in a scope chain with two outer
objects: A->B->G. Suppose A:P and P->G.

While recording, record_JSOP_BINDNAME calls test_property_cache on A,
looking for a property 'x' found on B. test_property_cache gets an
(atom,obj) cache entry and guards A's identity and B's shape.

Later, off trace, we add 'x' to P. P is a delegate, so we call
js_PurgeScopeChainHelper. This scans P's prototype and G, but finds
no existing 'x' property, and changes nobody's shape. However, note
that B's binding for 'x' is now shadowed by P's, visible via A.

We re-enter trace, find A's and B's shapes unchanged, and thus fetch
the property from B, instead of P as we should.

No?

[Igor Bukanov]

The interpreter in SM also does not detect additions to the prototype
chain when the property is coming from the parent,
https://bugzilla.mozilla.org/show_bug.cgi?id=487039 .

Igor

2009/4/4 Jim Blandy <ji...@mozilla.com>:

> _______________________________________________
> dev-tech-js-engine mailing list
> dev-tech-...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-tech-js-engine
>