JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes.

[Mark Lam]

<rdar://problem/46209355>

[Mark Lam]

Created attachment 359116 [details]
proposed patch.

[Saam Barati]

Comment on attachment 359116 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=359116&action=review

> Source/JavaScriptCore/runtime/JSFunctionInlines.h:125
> +        if (prototype.isCell()) {
> +            JSCell* cell = prototype.asCell();
> +            if (cell->isGetterSetter() || cell->isCustomGetterSetter() || cell->isProxy())
> +                return false;
> +        }

Not a fan of this. Can you do the structure lookup along w/ and inspect the bits that say if this is a getter/setter?

[Mark Lam]

Created attachment 359137 [details]
proposed patch.

[Saam Barati]

Comment on attachment 359137 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=359137&action=review

r=me

> Source/JavaScriptCore/ChangeLog:10
> +        because the majority of them has no prototype property.  The only exception to

s/has/have

> Source/JavaScriptCore/runtime/JSFunctionInlines.h:120
> +        if (!prototype || (attributes & PropertyAttribute::AccessorOrCustomAccessorOrValue))

Can we add a test case for this? Like define a getter as the prototype of a random builtin function.

[Mark Lam]

Created attachment 359239 [details]
patch for landing.

Thanks for the review.

[Mark Lam]

Landed in r240040: <http://trac.webkit.org/r240040>.