Bug 209777 – Delete IC incorrectly caches for proxies

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

We're seeing a ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to DeleteIC.  Here's the test case:

    function foo() {
        let j = 0;
        while (j++ < 2)
            delete this.x;
        Object.defineProperty(this, "x", {});
    }

    for (let i = 0; i < 5; i++)
        foo();

Run with --jitPolicyScale=0 --useDFGJIT=0 --useConcurrentJIT=0.

The duplicate cases are:
DeleteMiss:(Committed, ident = 'uid:(x)', structure = 0x10c4faee0:[0xf4c5, JSProxy, {}, NonArray, Proto:0x106dfa368, Leaf])
DeleteNonConfigurable:(Committed, ident = 'uid:(x)', structure = 0x10c4faee0:[0xf4c5, JSProxy, {}, NonArray, Proto:0x106dfa368, Leaf])

<rdar://problem/61051902>

[Justin Michaud]

Created attachment 395061 [details]
Patch

[Mark Lam]

Comment on attachment 395061 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395061&action=review

r=me

> JSTests/ChangeLog:8
> +        * stress/delete-property-ic-compatable.js: Added.

Can you also add variants of this test for the other proxy types?

> JSTests/stress/delete-property-ic-compatable.js:1
> +//@ requireOptions("--jitPolicyScale=0", "--useDFGJIT=0", "--useConcurrentJIT=0")

I think you can drop the "--useConcurrentJIT=0".  There will be a test configuration that handles that already.

[Justin Michaud]

Created attachment 395069 [details]
Patch

[Mark Lam]

Comment on attachment 395069 [details]
Patch

Please fix test name /compatable/compatible/.  Please also update the bug title in the ChangeLog since it has changed in bugzilla.  r=me

[Justin Michaud]

Created attachment 395074 [details]
Patch

[Saam Barati]

Comment on attachment 395074 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395074&action=review

> Source/JavaScriptCore/ChangeLog:9
> +        Proxy's do not change their structure ID when properties are added, so we cannot cache deletes
> +        for them.

why can't we cache delete on their target though (I mean w.r.t proxy like window, not like Proxy object in ES6)?

[Justin Michaud]

(In reply to Saam Barati from comment #6)
> Comment on attachment 395074 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=395074&action=review
> 
> > Source/JavaScriptCore/ChangeLog:9
> > +        Proxy's do not change their structure ID when properties are added, so we cannot cache deletes
> > +        for them.
> 
> why can't we cache delete on their target though (I mean w.r.t proxy like
> window, not like Proxy object in ES6)?

Filed a bug and related it to this bug.

[EWS]

Committed r259357: <https://trac.webkit.org/changeset/259357>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 395074 [details].