Let A:B mean that B is A's proto.
Let A->B mean B is A's parent.
objects: A->B->G. Suppose A:P and P->G.
While recording, record_JSOP_BINDNAME calls test_property_cache on A,
looking for a property 'x' found on B. test_property_cache gets an
(atom,obj) cache entry and guards A's identity and B's shape.
Later, off trace, we add 'x' to P. P is a delegate, so we call
js_PurgeScopeChainHelper. This scans P's prototype and G, but finds
no existing 'x' property, and changes nobody's shape. However, note
that B's binding for 'x' is now shadowed by P's, visible via A.
We re-enter trace, find A's and B's shapes unchanged, and thus fetch
the property from B, instead of P as we should.
2009/4/4 Jim Blandy <ji...@mozilla.com>:
> dev-tech-js-engine mailing list