Bug 156607 – We should support delete in the DFG

• Component: New Bugs
• Status: RESOLVED FIXED

[Keith Miller]

We should support delete in the DFG

[Keith Miller]

Created attachment 276460 [details]
Patch

[Keith Miller]

Created attachment 276461 [details]
Benchmark results

[Keith Miller]

I also tested this on a custom micro benchmark:

function test(condition) {
    if (condition)
        delete base.id;
    let result = [];
    for (let i = 0; i < 100; i++)
        result.push(i);
    return result;
}
noInline(test);

for (i = 0; i < 100000; i++)
    test(false);

And got:

delete-by-id        176.3282+-2.1856     ^     40.1055+-0.4254        ^ definitely 4.3966x faster

[Benjamin Poulain]

Comment on attachment 276460 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=276460&action=review

> Source/JavaScriptCore/jit/JITPropertyAccess.cpp:533
> +    emitTagBool(returnValueGPR);

I am not a fan of the change JSValue->bool.

The biggest problem of baseline JIT is binary size. We should instead go in the direction of making those load-store part of the slow path, not outside.

[Keith Miller]

Created attachment 276651 [details]
Patch for landing

[Keith Miller]

Created attachment 276655 [details]
Patch for landing

[Keith Miller]

Comment on attachment 276460 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=276460&action=review

>> Source/JavaScriptCore/jit/JITPropertyAccess.cpp:533
>> +    emitTagBool(returnValueGPR);
> 
> I am not a fan of the change JSValue->bool.
> 
> The biggest problem of baseline JIT is binary size. We should instead go in the direction of making those load-store part of the slow path, not outside.

Fixed. I created a second operation that returns the EncodedValue for the baseline.

[WebKit Commit Bot]

Comment on attachment 276655 [details]
Patch for landing

Clearing flags on attachment: 276655

Committed r199683: <http://trac.webkit.org/changeset/199683>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.