RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 16:37:47 +00:00
Code Issues Activity Actions

LibJS/Bytecode: Invalidate inline caches on unique shape mutation

Browse source 
Since we can't rely on shape identity (i.e its pointer address) for
unique shapes, give them a serial number that increments whenever a
mutation occurs.

Inline caches can then compare this serial number against what they
have seen before.
This commit is contained in:
Andreas Kling 2023-07-10 20:45:31 +02:00 • committed by Linus Groh
parent 17d23e76e5
commit cf6792ec40
6 changed files with 38 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Userland/Libraries/LibJS/Runtime/Shape.h
View file

@ -81,6 +81,8 @@ public:
void add_property_to_unique_shape(StringOrSymbol const&, PropertyAttributes attributes);
void reconfigure_property_in_unique_shape(StringOrSymbol const& property_key, PropertyAttributes attributes);
[[nodiscard]] u64 unique_shape_serial_number() const { return m_unique_shape_serial_number; }
private:
explicit Shape(Realm&);
Shape(Shape& previous_shape, StringOrSymbol const& property_key, PropertyAttributes attributes, TransitionType);
@ -107,6 +109,10 @@ private:
PropertyAttributes m_attributes { 0 };
TransitionType m_transition_type : 6 { TransitionType::Invalid };
bool m_unique : 1 { false };
// Since unique shapes never change identity, inline caches use this incrementing serial number
// to know whether its property table has been modified since last time we checked.
u64 m_unique_shape_serial_number { 0 };
};
}