[Webkit-unassigned] [Bug 162124] op_get_by_id_with_this should use inline caching

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=162124

--- Comment #60 from Yusuke Suzuki <utatane.tea at gmail.com> ---
Comment on attachment 297746
  --> https://bugs.webkit.org/attachment.cgi?id=297746
Patch Updated

View in context: https://bugs.webkit.org/attachment.cgi?id=297746&action=review

>> Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp:971
>> +                GPRReg baseForCustomGetGPR = baseGPR != thisGPR ? thisGPR : baseForGetGPR;
> 
> Is this correct? Does DOMJIT expect the property holder or the receiver? This is a good question for Yusuke.

DOMJIT custom getter assumes that the base value should be the DOM object.
So it is imcompatible with op_get_by_id_with_this.
For now, you can drop the DOMJIT acceleration support for `baseGPR != thisGPR` case.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170126/4ac9d5fb/attachment.html>