Modified: trunk/JSTests/ChangeLog (259806 => 259807)
--- trunk/JSTests/ChangeLog 2020-04-09 17:54:54 UTC (rev 259806)
+++ trunk/JSTests/ChangeLog 2020-04-09 17:59:06 UTC (rev 259807)
@@ -1,3 +1,15 @@
+2020-04-09 Saam Barati <sbar...@apple.com>
+
+ We can still cache delete in strict mode as long as the property is not "non-configurable"
+ https://bugs.webkit.org/show_bug.cgi?id=210148
+
+ Reviewed by Tadeu Zagallo.
+
+ * microbenchmarks/delete-cache-strict-mode.js: Added.
+ (assert):
+ (doDel):
+ (doDelByVal):
+
2020-04-09 Alexey Shvayka <shvaikal...@gmail.com>
getOwnPropertyDescriptor() is incorrect with Proxy of exotic object
Added: trunk/JSTests/microbenchmarks/delete-cache-strict-mode.js (0 => 259807)
--- trunk/JSTests/microbenchmarks/delete-cache-strict-mode.js (rev 0)
+++ trunk/JSTests/microbenchmarks/delete-cache-strict-mode.js 2020-04-09 17:59:06 UTC (rev 259807)
@@ -0,0 +1,36 @@
+"use strict";
+
+let objs = [
+ {x: 42},
+ {y: 42, z: 50},
+ {a: 42, b: 55}
+];
+
+let idents = [
+ "doesNotExist",
+ "doesNotExist2"
+];
+
+function assert(b) {
+ if (!b)
+ throw new Error;
+}
+
+function doDel(o) {
+ return delete o.doesNotExist;
+}
+noInline(doDel);
+
+function doDelByVal(o, v) {
+ return delete o[v];
+}
+noInline(doDelByVal);
+
+for (let i = 0; i < 1000000; ++i) {
+ for (let i = 0; i < objs.length; ++i) {
+ assert(doDel(objs[i]));
+
+ for (let j = 0; j < idents.length; ++j)
+ assert(doDelByVal(objs[i], idents[j]));
+ }
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (259806 => 259807)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-09 17:54:54 UTC (rev 259806)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-09 17:59:06 UTC (rev 259807)
@@ -1,3 +1,18 @@
+2020-04-09 Saam Barati <sbar...@apple.com>
+
+ We can still cache delete in strict mode as long as the property is not "non-configurable"
+ https://bugs.webkit.org/show_bug.cgi?id=210148
+
+ Reviewed by Tadeu Zagallo.
+
+ We were incorrectly not inline caching all delete misses in strict mode.
+ We only must to not cache deletes on non-configurable properties in strict
+ mode, as that should throw a runtime error. Delete misses can still be cached
+ in strict mode without any issues. This is a 4x speedup on the microbenchmark.
+
+ * jit/Repatch.cpp:
+ (JSC::tryCacheDeleteBy):
+
2020-04-09 Sergio Villar Senin <svil...@igalia.com>
[Wasm] Build fix for non-unified builds
Modified: trunk/Source/_javascript_Core/jit/Repatch.cpp (259806 => 259807)
--- trunk/Source/_javascript_Core/jit/Repatch.cpp 2020-04-09 17:54:54 UTC (rev 259806)
+++ trunk/Source/_javascript_Core/jit/Repatch.cpp 2020-04-09 17:59:06 UTC (rev 259807)
@@ -781,13 +781,14 @@
ASSERT(newStructure->isObject());
ASSERT(isValidOffset(newOffset));
newCase = AccessCase::createDelete(vm, codeBlock, propertyName, newOffset, oldStructure, newStructure);
- } else if (!ecmaMode.isStrict()) {
- if (slot.isNonconfigurable())
- newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteNonConfigurable, propertyName, invalidOffset, oldStructure, { }, nullptr);
- else
- newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteMiss, propertyName, invalidOffset, oldStructure, { }, nullptr);
- }
+ } else if (slot.isNonconfigurable()) {
+ if (ecmaMode.isStrict())
+ return GiveUpOnCache;
+ newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteNonConfigurable, propertyName, invalidOffset, oldStructure, { }, nullptr);
+ } else
+ newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteMiss, propertyName, invalidOffset, oldStructure, { }, nullptr);
+
result = stubInfo.addAccessCase(locker, globalObject, codeBlock, propertyName, WTFMove(newCase));
if (result.generatedSomeCode()) {
