Re: [JS-internals] Shape mysteries

2014-07-15 Thread Cameron McCormack
On 15/07/14 20:58, Boris Zbarsky wrote: Oh, wait, this is a getter, not a method. So this probably does mean we're giving each Event instance a unique shape! That's pretty sucky. We could try to share the getter across instances of a given Event subclass by caching the function somewhere, but

Re: [JS-internals] Shape mysteries

2014-07-15 Thread Boris Zbarsky
On 7/15/14, 6:36 AM, Boris Zbarsky wrote: That said, I'd think since shape doesn't cover function values events that are the same event type would share the same shape, no? Oh, wait, this is a getter, not a method. So this probably does mean we're giving each Event instance a unique shape!

Re: [JS-internals] Shape mysteries

2014-07-15 Thread Boris Zbarsky
On 7/15/14, 12:08 AM, Nicholas Nethercote wrote: And there are another 360-odd just like that. Lots of different generated DOM bindings classes that have an isTrusted method, basically. It's a little frustrating that we have so much generated code that is really similar. This case is a bit weir

Re: [JS-internals] Shape mysteries

2014-07-14 Thread Nicholas Nethercote
On a related note: class MouseEvent emptyShape id "isTrusted" g/s 0x7f0686017280/(nil) slot -1 attrs 55 (enumerate permanent getter shared) flags 0 nkids=0 id "isTrusted" g/s 0x7f066db02cc0/(nil) slot -1 attrs 55 (enumerate permanent getter shared) flags 0 nkids=0 id "isTrusted" g/s 0x7f06860

Re: [JS-internals] Shape mysteries

2014-07-14 Thread Nicholas Nethercote
On Mon, Jul 14, 2014 at 7:52 PM, Nicholas Nethercote wrote: > > In all three cases ObjectImpl::setFlag() gets called, which calls onto > Shape::replaceLastProperty(), which ends up "replacing" the shape by > creating one that's very similar but has a different flag... but the > original shape rema

Re: [JS-internals] Shape mysteries

2014-07-14 Thread Nicholas Nethercote
On Mon, Jul 14, 2014 at 6:48 PM, Bill McCloskey wrote: > I don't know about the duplicate length shape, although we do a lot of > weird stuff related to that, so it's not too surprising. Maybe it's > something related to this? > http://mxr.mozilla.org/mozilla-central/source/js/src/jsarray.cpp#67

Re: [JS-internals] Shape mysteries

2014-07-14 Thread Nicholas Nethercote
On Mon, Jul 14, 2014 at 6:48 PM, Bill McCloskey wrote: > > For the Function stuff, it sounds like maybe those are the shapes for > stuff like Array.join, Array.reverse, ... (as opposed to > Array.prototype.join, Array.prototype.reverse, ...). Array is just a > function after all. Aha! I didn't kn

Re: [JS-internals] Shape mysteries

2014-07-14 Thread Bill McCloskey
I don't know about the duplicate length shape, although we do a lot of weird stuff related to that, so it's not too surprising. Maybe it's something related to this? http://mxr.mozilla.org/mozilla-central/source/js/src/jsarray.cpp#679 For the Function stuff, it sounds like maybe those are the sh

[JS-internals] Shape mysteries

2014-07-14 Thread Nicholas Nethercote
Hi, I'm looking closely at shapes and property trees. I've been using the dump() and dumpSubtree() methods, among other things, and I'm seeing some strange things. Here's some reasonable-looking output: class Array emptyShape id "length" g/s 0x7f06ae61fb10/0x7f06ae61fbf0 slot -1 attrs 44 (perma