From bug 510642 comment 8: var d = 1; function heavy(x) { eval(x); return function lite() { var s = 0; for (var i = 0; i < 9; i++) s += d; return s; }; } var f1 = heavy("1"); var f2 = heavy("var d = 100;"); assertEq(f1(), 9); assertEq(f2(), 900); We get f2() == 9. The second call apparently doesn't notice the new 'd'. This might be missing shape guard in a call special case, but I don't really know yet.

The problem: when we record the trace, we find 'd' on the global object. The case for this in scopeChainProp then simply imports from the global object, without any guards. The second time we run the trace, we get from the global again, which is wrong. This is fixed if I add the "check shapes for all heavyweight objects up the chain" check to that case in scopeChainProp. It appears that the global shape does not change here; is that right?

Why doesn't PurgeProtoChain reshape the global? /be

(In reply to comment #2) > Why doesn't PurgeProtoChain reshape the global? I had to think about that for a while. It does reshape the global, but that doesn't save us. In this test, the global reshaping happens before any trace is run, so times we see the loop, we have the same global shape. But checking the heavyweights should work.

Brendan, it's a foreshadowing case.

Test case pushed to TM as 7a48e1cea3bd.