[Webkit-unassigned] [Bug 162124] op_get_by_id_with_this should use inline caching
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Jan 26 06:58:29 PST 2017
https://bugs.webkit.org/show_bug.cgi?id=162124
--- Comment #60 from Yusuke Suzuki <utatane.tea at gmail.com> ---
Comment on attachment 297746
--> https://bugs.webkit.org/attachment.cgi?id=297746
Patch Updated
View in context: https://bugs.webkit.org/attachment.cgi?id=297746&action=review
>> Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp:971
>> + GPRReg baseForCustomGetGPR = baseGPR != thisGPR ? thisGPR : baseForGetGPR;
>
> Is this correct? Does DOMJIT expect the property holder or the receiver? This is a good question for Yusuke.
DOMJIT custom getter assumes that the base value should be the DOM object.
So it is imcompatible with op_get_by_id_with_this.
For now, you can drop the DOMJIT acceleration support for `baseGPR != thisGPR` case.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170126/4ac9d5fb/attachment.html>
More information about the webkit-unassigned
mailing list