Getters/setters are currently stored in the shape tree, in AccessorShapes. The reasons for doing it this way were mostly historical, as far as I know: we already supported JSGetterOp and JSSetterOp getters/setters and that code was reused when implementing ES5 getter/setter objects.

There are a number of problems with this:

• Branchy shape trees when lambdas are used as getters/setters can result in performance cliffs and wasting memory. See the micro-benchmark below for an example of this.
• It complicates the shape code because data properties and accessor properties are so different.
• Certain changes to the object layout we're considering are not possible.

The plan here is as follows:

1. Remove JSGetterOp/JSSetterOp (bug 1404885). Today these are only used for array.length and ArgumentsObject, and I think we can handle these special cases with a special property attribute instead.

2. Add a GetterSetterPair GC thing, a tuple holding just the getter/setter objects. Use this in AccessorShape.

3. Store GetterSetterPair in an object slot as PrivateGCThingValue. Remove AccessorShape.

This will require an extra CacheIR guard for getter/setter calls. This is likely acceptable compared to the call overhead, and this could be optimized away in the future if needed (since most getters/setters are on prototype objects, we could use fuses to invalidate code when redefining an accessor property).

Here's a micro-benchmark where a getter property makes accessing a data property much slower (28 ms => 204 ms).

function init() {
	var objs = [];
	for (var i = 0; i < 128; i++) {
		objs.push({get foo() {}, x: 1});
	}
	return objs;
}
function test(objs) {
	var res = 0;
	for (var i = 0; i < 10_000_000; i++) {
		res += objs[i % 128].x;
	}
	return res;
}
var objs = init();
var t = dateNow();
var res = test(objs);
print(dateNow() - t);
print(res);

For now these just forward to the equivalent methods on the shape, but that
will change in a later patch.

This way the code will do the right thing when the shape no longer implies a specific
getter object.

A later patch will change this so we store just the slot number instead of the
species property shape.

Depends on D110248

Depends on D110249

This is preparing for a later patch.

Depends on D110250

Also clean up the similar Push method a bit to use PropertyKey instead of jsid.

Depends on D110251

We currently get the jsid from the property's shape, but in a later patch that
Shape* argument will be replaced with a GetterSetter* argument.

I considered using PropertyKey instead of jsid, but this matches similar code
using jsid.

Depends on D110252

This turned out to be a bit more work than expected because we were missing
branch32/branchPtr implementations taking a BaseIndex and a Register.

Depends on D110253

These will be used in a later patch to guard obj[slot] == PrivateGCThingValue(GetterSetter*).

Depends on D110254

Depends on D110255

Depends on D110256

There will be additional cleanup of the Shape code in follow-up patches.

Depends on D110257

Depends on D110258

Depends on D110259

Because these methods are now also used for accessor properties.

Depends on D110260

This is a bit faster than getting the slot number from the shape every time.

Depends on D110261

Depends on D110262

Use this instead of checking !isCustomDataProperty (and before this stack, !isDataProperty).

https://hg.mozilla.org/mozilla-central/rev/3af530ddacc9
https://hg.mozilla.org/mozilla-central/rev/d5eb51b405c4
https://hg.mozilla.org/mozilla-central/rev/56f4a105ca52
https://hg.mozilla.org/mozilla-central/rev/a4d18ab82fef
https://hg.mozilla.org/mozilla-central/rev/b3219fb7aa9b

https://hg.mozilla.org/mozilla-central/rev/8540f6f82ab6
https://hg.mozilla.org/mozilla-central/rev/bf62a6aa5aa4
https://hg.mozilla.org/mozilla-central/rev/a91c9a837ba6
https://hg.mozilla.org/mozilla-central/rev/fc6b5fb92749
https://hg.mozilla.org/mozilla-central/rev/7e3a27b38e56

https://hg.mozilla.org/mozilla-central/rev/c4825995d926
https://hg.mozilla.org/mozilla-central/rev/40b1b6f502ca
https://hg.mozilla.org/mozilla-central/rev/1bee1c7dabac
https://hg.mozilla.org/mozilla-central/rev/89d1c5483930
https://hg.mozilla.org/mozilla-central/rev/3ad3acac6cf6
https://hg.mozilla.org/mozilla-central/rev/55012db38df0
https://hg.mozilla.org/mozilla-central/rev/b00dca6a4995