mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 22:07:35 +00:00
LibJS/Bytecode: Invalidate inline caches on unique shape mutation
Since we can't rely on shape identity (i.e its pointer address) for unique shapes, give them a serial number that increments whenever a mutation occurs. Inline caches can then compare this serial number against what they have seen before.
This commit is contained in:
parent
17d23e76e5
commit
cf6792ec40
6 changed files with 38 additions and 5 deletions
18
Userland/Libraries/LibJS/Tests/inline-cache-edge-cases.js
Normal file
18
Userland/Libraries/LibJS/Tests/inline-cache-edge-cases.js
Normal file
|
@ -0,0 +1,18 @@
|
|||
test("Inline cache invalidated by deleting property from unique shape", () => {
|
||||
// Create an object with an unique shape by adding a huge amount of properties.
|
||||
let o = {};
|
||||
for (let x = 0; x < 1000; ++x) {
|
||||
o["prop" + x] = x;
|
||||
}
|
||||
|
||||
function ic(o) {
|
||||
return o.prop2;
|
||||
}
|
||||
|
||||
let first = ic(o);
|
||||
delete o.prop2;
|
||||
let second = ic(o);
|
||||
|
||||
expect(first).toBe(2);
|
||||
expect(second).toBeUndefined();
|
||||
});
|
Loading…
Add table
Add a link
Reference in a new issue