The assertion ASSERT(base.gpr() != params[2].gpr()) is wrong because it is legal JS to pass in the same value as the base and subscript. <rdar://problem/59940095>
Created attachment 392864 [details] proposed patch.
Comment on attachment 392864 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=392864&action=review > JSTests/stress/delete-by-val-with-base-and-subscript-using-same-cell.js:6 > +for (let i = 0; i < 1000000; i++) I'll reduce this count to 20000 before landing. That should be sufficient. > JSTests/stress/delete-by-val-with-base-and-subscript-using-same-non-cell.js:6 > +for (let i = 0; i < 1000000; i++) Ditto.
Created attachment 392865 [details] proposed patch.
Comment on attachment 392865 [details] proposed patch. r=me
Comment on attachment 392865 [details] proposed patch. Thanks for the review.
Comment on attachment 392865 [details] proposed patch. Clearing flags on attachment: 392865 Committed r258078: <https://trac.webkit.org/changeset/258078>
All reviewed patches have been landed. Closing bug.
Comment on attachment 392865 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=392865&action=review > Source/JavaScriptCore/ChangeLog:10 > + JS to pass in the same value as the base and subscript. The runtime will handle But does the inline cache handle it properly?
(In reply to Saam Barati from comment #8) > Comment on attachment 392865 [details] > proposed patch. > > View in context: > https://bugs.webkit.org/attachment.cgi?id=392865&action=review > > > Source/JavaScriptCore/ChangeLog:10 > > + JS to pass in the same value as the base and subscript. The runtime will handle > > But does the inline cache handle it properly? Yes. When I said “runtime”, I meant the inline cache as well.