Changeset 259807 in webkit

Timestamp:

Apr 9, 2020, 10:59:06 AM (6 years ago)

Author:

sbarati@apple.com

Message:

We can still cache delete in strict mode as long as the property is not "non-configurable"
​https://bugs.webkit.org/show_bug.cgi?id=210148

Reviewed by Tadeu Zagallo.

JSTests:

• microbenchmarks/delete-cache-strict-mode.js: Added.

(assert):
(doDel):
(doDelByVal):

Source/JavaScriptCore:

We were incorrectly not inline caching all delete misses in strict mode.
We only must to not cache deletes on non-configurable properties in strict
mode, as that should throw a runtime error. Delete misses can still be cached
in strict mode without any issues. This is a 4x speedup on the microbenchmark.

• jit/Repatch.cpp:

(JSC::tryCacheDeleteBy):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/delete-cache-strict-mode.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/Repatch.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-09  Saam Barati  <sbarati@apple.com>
+
+        We can still cache delete in strict mode as long as the property is not "non-configurable"
+        https://bugs.webkit.org/show_bug.cgi?id=210148
+
+        Reviewed by Tadeu Zagallo.
+
+        * microbenchmarks/delete-cache-strict-mode.js: Added.
+        (assert):
+        (doDel):
+        (doDelByVal):
+
 2020-04-09  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-09  Saam Barati  <sbarati@apple.com>
+
+        We can still cache delete in strict mode as long as the property is not "non-configurable"
+        https://bugs.webkit.org/show_bug.cgi?id=210148
+
+        Reviewed by Tadeu Zagallo.
+
+        We were incorrectly not inline caching all delete misses in strict mode.
+        We only must to not cache deletes on non-configurable properties in strict
+        mode, as that should throw a runtime error. Delete misses can still be cached
+        in strict mode without any issues. This is a 4x speedup on the microbenchmark.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheDeleteBy):
+
 2020-04-09  Sergio Villar Senin  <svillar@igalia.com>
 

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -782 +782 @@
             ASSERT(isValidOffset(newOffset));
             newCase = AccessCase::createDelete(vm, codeBlock, propertyName, newOffset, oldStructure, newStructure);
-        } else if (!ecmaMode.isStrict()) {
-            if (slot.isNonconfigurable())
-                newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteNonConfigurable, propertyName, invalidOffset, oldStructure, { }, nullptr);
-            else
-                newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteMiss, propertyName, invalidOffset, oldStructure, { }, nullptr);
-        }
+        } else if (slot.isNonconfigurable()) {
+            if (ecmaMode.isStrict())
+                return GiveUpOnCache;
+
+            newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteNonConfigurable, propertyName, invalidOffset, oldStructure, { }, nullptr);
+        } else
+            newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteMiss, propertyName, invalidOffset, oldStructure, { }, nullptr);
 
         result = stubInfo.addAccessCase(locker, globalObject, codeBlock, propertyName, WTFMove(newCase));