[webkit-reviews] review granted: [Bug 207522] Inline Cache delete by id/val : [Attachment 391427] Patch

[bugzilla-daemon at webkit.org]

Keith Miller <keith_miller at apple.com> has granted Justin Michaud
<justin_michaud at apple.com>'s request for review:
Bug 207522: Inline Cache delete by id/val
https://bugs.webkit.org/show_bug.cgi?id=207522

Attachment 391427: Patch

https://bugs.webkit.org/attachment.cgi?id=391427&action=review




--- Comment #28 from Keith Miller <keith_miller at apple.com> ---
Comment on attachment 391427
  --> https://bugs.webkit.org/attachment.cgi?id=391427
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=391427&action=review

r=me with some comments and a question:

What happens if you have something like:

let obj = {};
obj.foo = 1
obj.bar = 2;
delete obj.foo;
obj.baz = 3;
delete obj.bar;
delete obj.baz;


Is obj's structure now the same as when it was first created?

> Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:193
> +	   fastPath, slowPath,
fastPath.locationOf<JITStubRoutinePtrTag>(m_start));

I think you can just replace m_start with `m_slowPathJump.m_jump.label()`? That
way you don't need m_start at all.

> Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:224
> +	   fastPath, slowPath,
fastPath.locationOf<JITStubRoutinePtrTag>(m_start));

Ditto.