property cache tracing doubts

Skip to first unread message

Jim Blandy

Apr 4, 2009, 4:34:03 AM4/4/09
(Warning: I haven't actually put together a test program to verify
that everything here happens as I claim, but it's late, so I'll do
that tomorrow and just post this now for folks' amusement.)

Let A:B mean that B is A's proto.
Let A->B mean B is A's parent.

Suppose I'm evaluating JavaScript in a scope chain with two outer
objects: A->B->G. Suppose A:P and P->G.

While recording, record_JSOP_BINDNAME calls test_property_cache on A,
looking for a property 'x' found on B. test_property_cache gets an
(atom,obj) cache entry and guards A's identity and B's shape.

Later, off trace, we add 'x' to P. P is a delegate, so we call
js_PurgeScopeChainHelper. This scans P's prototype and G, but finds
no existing 'x' property, and changes nobody's shape. However, note
that B's binding for 'x' is now shadowed by P's, visible via A.

We re-enter trace, find A's and B's shapes unchanged, and thus fetch
the property from B, instead of P as we should.


Igor Bukanov

Apr 6, 2009, 11:12:54 AM4/6/09
to Jim Blandy,
The interpreter in SM also does not detect additions to the prototype
chain when the property is coming from the parent, .


2009/4/4 Jim Blandy <>:

> _______________________________________________
> dev-tech-js-engine mailing list

Reply all
Reply to author
0 new messages