Repository navigation
Conversation
…shape On an inline cache miss, `GetPropertyByName` and `SetPropertyByName` cached the slot found by the lookup under the object's shape read after the get or set. A prototype getter or setter that defines an own property on the receiver changes that shape, so the new shape was cached with the prototype accessor's slot, and every later access at that site called the accessor again instead of reading or writing the own property. The shape is now read before the access, and the slot is cached only if the shape is unchanged. Fixes boa-dev#5600
github-actions
Bot
added
Waiting On Review
Test262 conformance changes
Tested main commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5601 +/- ##
===========================================
+ Coverage 47.24% 63.08% +15.83%
===========================================
Files 476 536 +60
Lines 46892 60538 +13646
===========================================
+ Hits 22154 38189 +16035
+ Misses 24738 22349 -2389 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
lehni
added a commit
to lehni/vectorcraft
that referenced
this pull request
Oct 21, 2026
…oa#5600 (boa-dev/boa#5601), so the Boa engine keeps a move made right after an item reloaded; its test runs again
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On an inline cache miss,
GetPropertyByNameandSetPropertyByNamecall__get__/__set__and only afterwards read the object's shape to cache(shape, slot). If a prototype getter or setter defines an own property on the receiver, that shape is the new one, so it gets cached with the slot of the prototype accessor. Every later access at that site then hits the cache and calls the accessor again, instead of reading or writing the own property (#5600: the getter runs 3 times where V8 runs it once).The fix reads the shape before the access and caches the slot only if the shape is unchanged: the slot was found in the old shape, so it isn't valid for the new one.
Tests: two regression tests in
vm/inline_cache/tests.rs. A prototype getter that shadows itself runs once, and a prototype setter that shadows itself runs once, with later writes going to the own property. Both fail without the fix.Note:
GetNameGlobalhas the same pattern, but the default global object has a unique shape, which gains properties in place without changing address, so a shape check can't see the change there. That's a separate issue with unique shapes and inline caches (it also shows without any accessor), left out of this PR.Fixes #5600