Bug 156607

Summary: We should support delete in the DFG
Product: WebKit Reporter: Keith Miller <keith_miller>
Component: New BugsAssignee: Keith Miller <keith_miller>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, mark.lam, msaboff, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Benchmark results
none
Patch for landing
none
Patch for landing none

Description Keith Miller 2016-04-14 16:11:49 PDT
We should support delete in the DFG
Comment 1 Keith Miller 2016-04-14 22:23:10 PDT
Created attachment 276460 [details]
Patch
Comment 2 Keith Miller 2016-04-14 22:26:41 PDT
Created attachment 276461 [details]
Benchmark results
Comment 3 Keith Miller 2016-04-14 22:27:46 PDT
I also tested this on a custom micro benchmark:

function test(condition) {
    if (condition)
        delete base.id;
    let result = [];
    for (let i = 0; i < 100; i++)
        result.push(i);
    return result;
}
noInline(test);

for (i = 0; i < 100000; i++)
    test(false);

And got:

delete-by-id        176.3282+-2.1856     ^     40.1055+-0.4254        ^ definitely 4.3966x faster
Comment 4 Benjamin Poulain 2016-04-15 16:37:15 PDT
Comment on attachment 276460 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=276460&action=review

> Source/JavaScriptCore/jit/JITPropertyAccess.cpp:533
> +    emitTagBool(returnValueGPR);

I am not a fan of the change JSValue->bool.

The biggest problem of baseline JIT is binary size. We should instead go in the direction of making those load-store part of the slow path, not outside.
Comment 5 Keith Miller 2016-04-18 12:05:30 PDT
Created attachment 276651 [details]
Patch for landing
Comment 6 Keith Miller 2016-04-18 12:10:23 PDT
Created attachment 276655 [details]
Patch for landing
Comment 7 Keith Miller 2016-04-18 12:12:02 PDT
Comment on attachment 276460 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=276460&action=review

>> Source/JavaScriptCore/jit/JITPropertyAccess.cpp:533
>> +    emitTagBool(returnValueGPR);
> 
> I am not a fan of the change JSValue->bool.
> 
> The biggest problem of baseline JIT is binary size. We should instead go in the direction of making those load-store part of the slow path, not outside.

Fixed. I created a second operation that returns the EncodedValue for the baseline.
Comment 8 WebKit Commit Bot 2016-04-18 13:02:10 PDT
Comment on attachment 276655 [details]
Patch for landing

Clearing flags on attachment: 276655

Committed r199683: <http://trac.webkit.org/changeset/199683>
Comment 9 WebKit Commit Bot 2016-04-18 13:02:13 PDT
All reviewed patches have been landed.  Closing bug.