We're seeing a ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to DeleteIC. Here's the test case: function foo() { let j = 0; while (j++ < 2) delete this.x; Object.defineProperty(this, "x", {}); } for (let i = 0; i < 5; i++) foo(); Run with --jitPolicyScale=0 --useDFGJIT=0 --useConcurrentJIT=0. The duplicate cases are: DeleteMiss:(Committed, ident = 'uid:(x)', structure = 0x10c4faee0:[0xf4c5, JSProxy, {}, NonArray, Proto:0x106dfa368, Leaf]) DeleteNonConfigurable:(Committed, ident = 'uid:(x)', structure = 0x10c4faee0:[0xf4c5, JSProxy, {}, NonArray, Proto:0x106dfa368, Leaf]) <rdar://problem/61051902>
Created attachment 395061 [details] Patch
Comment on attachment 395061 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395061&action=review r=me > JSTests/ChangeLog:8 > + * stress/delete-property-ic-compatable.js: Added. Can you also add variants of this test for the other proxy types? > JSTests/stress/delete-property-ic-compatable.js:1 > +//@ requireOptions("--jitPolicyScale=0", "--useDFGJIT=0", "--useConcurrentJIT=0") I think you can drop the "--useConcurrentJIT=0". There will be a test configuration that handles that already.
Created attachment 395069 [details] Patch
Comment on attachment 395069 [details] Patch Please fix test name /compatable/compatible/. Please also update the bug title in the ChangeLog since it has changed in bugzilla. r=me
Created attachment 395074 [details] Patch
Comment on attachment 395074 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395074&action=review > Source/JavaScriptCore/ChangeLog:9 > + Proxy's do not change their structure ID when properties are added, so we cannot cache deletes > + for them. why can't we cache delete on their target though (I mean w.r.t proxy like window, not like Proxy object in ES6)?
(In reply to Saam Barati from comment #6) > Comment on attachment 395074 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=395074&action=review > > > Source/JavaScriptCore/ChangeLog:9 > > + Proxy's do not change their structure ID when properties are added, so we cannot cache deletes > > + for them. > > why can't we cache delete on their target though (I mean w.r.t proxy like > window, not like Proxy object in ES6)? Filed a bug and related it to this bug.
Committed r259357: <https://trac.webkit.org/changeset/259357> All reviewed patches have been landed. Closing bug and clearing flags on attachment 395074 [details].