1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 12:07:45 +00:00

LibJS/Bytecode: Invalidate inline caches on unique shape mutation

Since we can't rely on shape identity (i.e its pointer address) for
unique shapes, give them a serial number that increments whenever a
mutation occurs.

Inline caches can then compare this serial number against what they
have seen before.
This commit is contained in:
Andreas Kling 2023-07-10 20:45:31 +02:00 committed by Linus Groh
parent 17d23e76e5
commit cf6792ec40
6 changed files with 38 additions and 5 deletions

View file

@ -0,0 +1,18 @@
test("Inline cache invalidated by deleting property from unique shape", () => {
// Create an object with an unique shape by adding a huge amount of properties.
let o = {};
for (let x = 0; x < 1000; ++x) {
o["prop" + x] = x;
}
function ic(o) {
return o.prop2;
}
let first = ic(o);
delete o.prop2;
let second = ic(o);
expect(first).toBe(2);
expect(second).toBeUndefined();
});