Bug 925790 - Fix Octane/V8 SETPROP performance regression from bug 918584. r=shu
authorJan de Mooij <jdemooij@mozilla.com>
Fri, 11 Oct 2013 20:24:33 +0200
changeset 150532 35167e0cc3193e0f7ed90fe1a34f5350a58fd280
parent 150531 c3d14caa839ac76b0d1f8b0d6687e28b486f7617
child 150533 7d0d6326133f7f6df06d7791b4a85b1e53d4e55f
push id25446
push userkwierso@gmail.com
push dateSat, 12 Oct 2013 01:50:20 +0000
treeherdermozilla-central@73f37c7a3860 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersshu
bugs925790, 918584
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 925790 - Fix Octane/V8 SETPROP performance regression from bug 918584. r=shu
js/src/jit/IonCaches.cpp
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -2726,18 +2726,20 @@ CanAttachNativeSetProp(HandleObject obj,
         return SetPropertyIC::CanAttachSetSlot;
 
     // If we couldn't find the property on the object itself, do a full, but
     // still pure lookup for setters.
     if (!LookupPropertyPure(obj, id, holder.address(), shape.address()))
         return SetPropertyIC::CanAttachNone;
 
     // If the object doesn't have the property, we don't know if we can attach
-    // a stub to add the property until we do the VM call to add.
-    if (!shape)
+    // a stub to add the property until we do the VM call to add. If the
+    // property exists as a data property on the prototype, we should add
+    // a new, shadowing property.
+    if (!shape || (obj != holder && shape->hasDefaultSetter() && shape->hasSlot()))
         return SetPropertyIC::MaybeCanAttachAddSlot;
 
     if (IsCacheableSetPropCallPropertyOp(obj, holder, shape) ||
         IsCacheableSetPropCallNative(obj, holder, shape))
     {
         return SetPropertyIC::CanAttachCallSetter;
     }