tree b1743d0dce99040411e1bd76d1eacec0ce3fea46
parent 6f5594cf5bdb0f560215b9a421e71e9d58be70d5
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1585768220 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1585768220 +0000

Delete IC incorrectly caches for proxies
https://bugs.webkit.org/show_bug.cgi?id=209777

Patch by Justin Michaud <justin@justinmichaud.com> on 2020-04-01
Reviewed by Mark Lam.

JSTests:

* stress/delete-property-ic-proxy.js: Added.
(obj1.this.foo1):
(foo1.foo2):
(foo1):
(foo2.foo3):
(foo2):
* stress/delete-property-inline-cache.js:

Source/JavaScriptCore:

Proxy's do not change their structure ID when properties are added, so we cannot cache deletes
for them.

* jit/Repatch.cpp:
(JSC::tryCacheDeleteBy):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259357 268f45cc-cd09-0410-ab3c-d52691b4dbfc