Bug 150983 - We should treat structures that vary solely in their prototype as a single polymorphic type.
Summary: We should treat structures that vary solely in their prototype as a single po...
Status: RESOLVED DUPLICATE of bug 176391
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Miller
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-11-06 16:12 PST by Keith Miller
Modified: 2017-09-05 14:24 PDT (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Miller 2015-11-06 16:12:25 PST 
Consider the following code:

function foo()
    function Bar(x) {
        this.x = x;
    }

    return new Bar(1);
}

Every time foo() is called the returned value will have a different prototype. At some point, probably the second time we construct a new Bar() we should convert the structure into a new one that instead indicates we should get the prototype off the object itself rather than off the structure. This would prevent inline caches from becoming megamorphic.
Comment 1 Keith Miller 2017-09-05 14:24:58 PDT 

*** This bug has been marked as a duplicate of bug 176391 ***