refactor: Vm 状态分组、dispatch 拆分为分发表、IC 辅助函数独立成模块

crates/oxide_vm/src/dispatch/arithmetic.rs

@@ -19,4 +19,108 @@ impl Vm {
         }
         Ok(())
     }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_neg(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let v = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(-v);
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_unary_plus(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let v = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(v);
+        Ok(())
+    }
+
+    pub(crate) fn dispatch_compound_add(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let lhs = self.coerce_primitive_bounded(self.regs[rd], false)?;
+        let rhs = self.coerce_primitive_bounded(self.regs[a], false)?;
+        if lhs.is_string() || rhs.is_string() {
+            let ls = coercion::to_string(lhs);
+            let rs = coercion::to_string(rhs);
+            let concat = format!("{ls}{rs}");
+            self.regs[rd] = self.new_string(&concat);
+        } else {
+            let ln = coercion::to_number(lhs);
+            let rn = coercion::to_number(rhs);
+            self.regs[rd] = JsValue::float(ln + rn);
+        }
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_compound_sub(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let l = self.coerce_number_bounded(self.regs[rd])?;
+        let r = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(l - r);
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_compound_mul(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let l = self.coerce_number_bounded(self.regs[rd])?;
+        let r = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(l * r);
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_compound_div(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let l = self.coerce_number_bounded(self.regs[rd])?;
+        let r = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(l / r);
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_compound_mod(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let l = self.coerce_number_bounded(self.regs[rd])?;
+        let r = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(l % r);
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_compound_exp(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let l = self.coerce_number_bounded(self.regs[rd])?;
+        let r = self.coerce_number_bounded(self.regs[a])?;
+        self.regs[rd] = JsValue::float(l.powf(r));
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_inc_pre(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let n = self.coerce_number_bounded(self.regs[rd])?;
+        let result = JsValue::float(n + 1.0);
+        self.regs[rd] = result;
+        self.regs[a] = result;
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_inc_post(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let n = self.coerce_number_bounded(self.regs[rd])?;
+        self.regs[a] = JsValue::float(n);
+        self.regs[rd] = JsValue::float(n + 1.0);
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_dec_pre(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let n = self.coerce_number_bounded(self.regs[rd])?;
+        let result = JsValue::float(n - 1.0);
+        self.regs[rd] = result;
+        self.regs[a] = result;
+        Ok(())
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_dec_post(&mut self, rd: usize, a: usize) -> Result<(), String> {
+        let n = self.coerce_number_bounded(self.regs[rd])?;
+        self.regs[a] = JsValue::float(n);
+        self.regs[rd] = JsValue::float(n - 1.0);
+        Ok(())
+    }
 }

crates/oxide_vm/src/dispatch/call.rs

@@ -1,9 +1,11 @@
 use crate::native::NativeFn;
-use crate::vm::{native_fn_ptr_to_fn, FrameContinuation, Vm};
+use crate::vm::{native_fn_ptr_to_fn, CallFrame, FrameContinuation, Vm};
+use oxide_bytecode::opcode;
 use oxide_kernel::{builtins_debug, builtins_trace};
 use oxide_runtime_api::NativeResult;
 use oxide_types::object::JsObject;
 use oxide_types::value::JsValue;
+use std::sync::Arc;
 
 impl Vm {
     #[inline(always)]
@@ -73,3 +75,241 @@ impl Vm {
         }
     }
 }
+
+impl Vm {
+    pub(crate) fn dispatch_create_closure(&mut self, rd: usize, instr: u32) {
+        let sub_idx = opcode::imm16(instr) as u32;
+        debug_assert!(sub_idx > 0 && (sub_idx as usize) <= self.sub_modules.len());
+        let sub = &self.sub_modules[sub_idx as usize - 1];
+        let result = self.create_function_object(
+            sub_idx,
+            sub.is_arrow,
+            sub.is_class_constructor,
+            sub.is_derived_constructor,
+            sub.needs_home_object,
+        );
+        self.regs[rd] = result;
+    }
+
+    pub(crate) fn dispatch_create_regexp(&mut self, rd: usize, a: usize, b: usize) -> Result<Option<JsValue>, String> {
+        let pat_val = self.regs[a];
+        let flags_val = self.regs[b];
+        let ctor_ptr = self.session.builtin_world().regexp_constructor.as_ptr() as *mut JsObject;
+        let ctor = unsafe { &*ctor_ptr };
+        let Some(native_fn) = ctor.native_fn() else {
+            self.raise_error_kind("TypeError", "RegExp constructor unavailable")?;
+            return Ok(Some(JsValue::undefined()));
+        };
+        let saved_0 = self.regs[0];
+        let saved_1 = self.regs[1];
+        let saved_2 = self.regs[2];
+        self.regs[0] = JsValue::undefined();
+        self.regs[1] = pat_val;
+        self.regs[2] = flags_val;
+        let func = unsafe { native_fn_ptr_to_fn(native_fn) };
+        let result = match func(self, &[0, 1, 2]) {
+            NativeResult::Ok(v) => v,
+            NativeResult::Err(e) => {
+                return Err(self.error_message_text("TypeError", &self.error_text(e)));
+            }
+            NativeResult::TailCall { .. } => {
+                return Err(self.error_message_text("TypeError", "unexpected tail call"));
+            }
+        };
+        self.regs[0] = saved_0;
+        self.regs[1] = saved_1;
+        self.regs[2] = saved_2;
+        self.regs[rd] = result;
+        Ok(None)
+    }
+
+    pub(crate) fn dispatch_super_call(&mut self, rd: usize, a: usize) -> Result<bool, String> {
+        let first_arg_reg = a as u8;
+        let ext = self.bytecode[self.pc];
+        self.pc += 1;
+        let arg_count = (ext & 0xFF) as usize;
+
+        let Some(frame) = self.frames.last() else {
+            self.raise_error_kind("ReferenceError", "super() used outside class constructor")?;
+            return Ok(true);
+        };
+        if !frame.is_derived_constructor {
+            self.raise_error_kind("ReferenceError", "super() used outside derived constructor")?;
+            return Ok(true);
+        }
+        if !self.regs[254].is_undefined() {
+            self.raise_error_kind("ReferenceError", "super() called more than once")?;
+            return Ok(true);
+        }
+        let Some(derived_this) = frame.constructed_this else {
+            self.raise_error_kind("ReferenceError", "super() without derived this")?;
+            return Ok(true);
+        };
+
+        let new_target = self.regs[255];
+        if !new_target.is_object() {
+            self.raise_error_kind("TypeError", "super() new.target is not an object")?;
+            return Ok(true);
+        }
+        let new_target_obj = unsafe { &*new_target.as_js_object_ptr() };
+        let super_ctor = new_target_obj.proto();
+        if !super_ctor.is_object() {
+            self.raise_error_kind("TypeError", "super constructor is not an object")?;
+            return Ok(true);
+        }
+        let super_obj = unsafe { &*super_ctor.as_js_object_ptr() };
+        if !super_obj.is_function() {
+            self.raise_error_kind("TypeError", "super constructor is not a function")?;
+            return Ok(true);
+        }
+
+        if super_obj.native_fn().is_some() {
+            self.regs[253] = derived_this;
+            self.regs[254] = super_ctor; // bind_dispatcher reads regs[254] as the wrapper callee
+            let (args_buf, len) = Self::build_native_args(first_arg_reg, arg_count, 253);
+            // SAFETY: native_fn was set via set_native_fn with a valid NativeFn pointer;
+            // native_fn_ptr_to_fn is the single coercion point for NativeFnPtr → NativeFn.
+            let func: NativeFn = unsafe { native_fn_ptr_to_fn(super_obj.native_fn().unwrap()) };
+            match func(self, &args_buf[..len]) {
+                NativeResult::Ok(val) => {
+                    self.regs[254] = if val.is_object() { val } else { derived_this };
+                    self.regs[rd] = self.regs[254];
+                }
+                NativeResult::Err(err_val) => {
+                    self.exception_value = Some(err_val);
+                    self.pending_error_kind = Some(self.thrown_error_kind(err_val));
+                    match self.unwind() {
+                        Ok(()) => return Ok(true),
+                        Err(e) => return Err(e),
+                    }
+                }
+                NativeResult::TailCall { callee, this, args } => {
+                    // e.g. bound function: resolve the tail call, use its return
+                    // value as the constructed instance (or fall back to derived_this).
+                    match self.call_function_sync(callee, this, &args) {
+                        Ok(val) => {
+                            self.regs[254] = if val.is_object() { val } else { derived_this };
+                            self.regs[rd] = self.regs[254];
+                        }
+                        Err(e) => return Err(e),
+                    }
+                }
+            }
+        } else if super_obj.sub_module_index() > 0 {
+            let sub_idx = super_obj.sub_module_index() as usize - 1;
+            if sub_idx >= self.sub_modules.len() {
+                return Err(format!(
+                    "SUPER_CALL: sub_module_index {} out of bounds (max {})",
+                    sub_idx,
+                    self.sub_modules.len()
+                ));
+            }
+            if self.frames.len() >= self.kernel_core.config.max_call_depth {
+                return Err(self.error_message_text("RangeError", "Maximum call stack size exceeded"));
+            }
+
+            let sub_bytecode = self.sub_modules[sub_idx].bytecode.clone();
+            let sub_n_args = self.sub_modules[sub_idx].n_args as usize;
+            let sub_n_registers = self.sub_modules[sub_idx].n_registers;
+            let sub_param_base = self.sub_modules[sub_idx].param_base as usize;
+            let caller_reg_limit = self.active_reg_limit.max(1);
+            let saved_reg_offset = self.save_stack.len() as u32;
+            self.save_stack.extend_from_slice(&self.regs[..caller_reg_limit as usize]);
+            let saved_this = self.regs[254];
+            let saved_new_target = self.regs[255];
+
+            for i in 0..sub_n_args {
+                let src_reg = first_arg_reg.wrapping_add(i as u8) as usize;
+                self.regs[sub_param_base + i] = self.regs[src_reg];
+            }
+            self.regs[254] = derived_this;
+            self.regs[255] = new_target;
+
+            self.saved_bytecode_stack.push(std::mem::take(&mut self.bytecode));
+            self.saved_immutables_stack.push(self.active_immutables);
+            self.frames.push(CallFrame {
+                return_addr: self.pc,
+                function_name: self.sub_modules[sub_idx]
+                    .function_name
+                    .as_deref()
+                    .map(|name| self.kernel_core.perm_interner().intern(name).0)
+                    .unwrap_or(0),
+                caller_reg_limit,
+                saved_reg_offset,
+                saved_this,
+                saved_new_target,
+                callee: super_ctor,
+                construct_result_reg: Some(254),
+                constructed_this: Some(derived_this),
+                is_derived_constructor: super_obj.is_derived_constructor(),
+                continuation: FrameContinuation::None,
+            });
+
+            self.bytecode = sub_bytecode;
+            let subs = Arc::clone(&self.sub_modules);
+            self.activate_immutables(sub_idx + 1, &subs[sub_idx].constants);
+            for (name, reg) in &self.sub_modules[sub_idx].builtin_reg_map {
+                let si = self.kernel_core.perm_interner().intern(name.as_str()).0;
+                let global = self.session.global_object();
+                if let Some(pos) = self.kernel_core.shape_forge().lookup_position(global.shape_id(), si) {
+                    self.regs[*reg as usize] = global.get_prop_at(pos);
+                }
+            }
+            self.active_reg_limit = sub_n_registers.max(1);
+            self.pc = 0;
+            return Ok(true);
+        } else {
+            self.raise_error_kind("TypeError", "super constructor is not callable")?;
+            return Ok(true);
+        }
+        Ok(false)
+    }
+
+    pub(crate) fn dispatch_super_get_prop(&mut self, rd: usize, a: usize, b: usize) -> Result<bool, String> {
+        let key_val = self.regs[b];
+        let prop_name_si = self.property_key_si(key_val);
+        let Some(frame) = self.frames.last() else {
+            self.raise_error_kind("ReferenceError", "super property used outside function")?;
+            return Ok(true);
+        };
+        if !frame.callee.is_object() {
+            self.raise_error_kind("ReferenceError", "super property has no home object")?;
+            return Ok(true);
+        }
+        let callee_obj = unsafe { &*frame.callee.as_js_object_ptr() };
+        let home_object = callee_obj.home_object();
+        if !home_object.is_object() {
+            self.raise_error_kind("ReferenceError", "super property has no home object")?;
+            return Ok(true);
+        }
+        let home_obj = unsafe { &*home_object.as_js_object_ptr() };
+        let super_base = home_obj.proto();
+        if !super_base.is_object() {
+            self.regs[rd] = JsValue::undefined();
+        } else {
+            let super_obj = unsafe { &*super_base.as_js_object_ptr() };
+            let val = self.ordinary_get_with_target(super_obj, prop_name_si, self.regs[a], rd as u8)?;
+            if self.accessor_frame_target_reg.take().is_none() {
+                self.regs[rd] = val;
+            }
+        }
+        Ok(false)
+    }
+
+    pub(crate) fn dispatch_set_home_object(&mut self, rd: usize, a: usize) -> Result<bool, String> {
+        let func_val = self.regs[rd];
+        let home_val = self.regs[a];
+        if !func_val.is_object() || !home_val.is_object() {
+            self.raise_error_kind("TypeError", "SET_HOME_OBJECT expects function and object")?;
+            return Ok(true);
+        }
+        let home_val = self.promote_if_needed_for_write_ptr(func_val.as_js_object_ptr(), home_val);
+        let func_obj = unsafe { &mut *func_val.as_js_object_ptr() };
+        if !func_obj.is_function() {
+            self.raise_error_kind("TypeError", "SET_HOME_OBJECT target is not a function")?;
+            return Ok(true);
+        }
+        func_obj.set_home_object(home_val);
+        Ok(false)
+    }
+}

crates/oxide_vm/src/dispatch/control_flow.rs

@@ -1,8 +1,41 @@
 use crate::coercion;
 use crate::vm::Vm;
+use oxide_bytecode::opcode::{self, Instr};
 use oxide_types::value::JsValue;
 
 impl Vm {
+    #[inline(always)]
+    pub(crate) fn dispatch_jmp(&mut self, instr: Instr) {
+        let offset = opcode::offset16(instr) as isize;
+        self.pc = ((self.pc as isize) + offset - 1) as usize;
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_jmp_if_false(&mut self, rd: usize, instr: Instr) {
+        let cond = coercion::to_boolean(self.regs[rd]);
+        if !cond {
+            let offset = opcode::offset16(instr) as isize;
+            self.pc = ((self.pc as isize) + offset - 1) as usize;
+        }
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_jmp_if_true(&mut self, rd: usize, instr: Instr) {
+        let cond = coercion::to_boolean(self.regs[rd]);
+        if cond {
+            let offset = opcode::offset16(instr) as isize;
+            self.pc = ((self.pc as isize) + offset - 1) as usize;
+        }
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_jmp_if_nullish(&mut self, rd: usize, instr: Instr) {
+        if self.regs[rd].is_nullish() {
+            let offset = opcode::offset16(instr) as isize;
+            self.pc = ((self.pc as isize) + offset - 1) as usize;
+        }
+    }
+
     #[inline(always)]
     pub(crate) fn dispatch_and(&mut self, rd: usize, a: usize, b: usize) {
         let val = self.regs[a];

crates/oxide_vm/src/dispatch/misc.rs

@@ -1,4 +1,8 @@
 use crate::vm::Vm;
+use oxide_bytecode::opcode;
+use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
+use oxide_types::object::JsObject;
+use oxide_types::value::JsValue;
 
 impl Vm {
     #[inline(always)]
@@ -40,4 +44,51 @@ impl Vm {
         };
         self.regs[rd] = self.new_string(result);
     }
+
+    pub(crate) fn dispatch_load_var(&mut self, rd: usize, a: usize) -> Result<bool, String> {
+        if a == 254
+            && self.frames.last().map(|frame| frame.is_derived_constructor).unwrap_or(false)
+            && self.regs[a].is_undefined()
+        {
+            self.raise_error_kind("ReferenceError", "must call super constructor before using 'this'")?;
+            return Ok(true);
+        }
+        self.regs[rd] = self.regs[a];
+        Ok(false)
+    }
+
+    pub(crate) fn dispatch_store_var(&mut self, rd: usize, a: usize, b: usize) -> Result<bool, String> {
+        if b != 0 {
+            // const guard: check if already initialized
+            if !self.regs[rd].is_undefined() {
+                self.raise_error_kind("TypeError", "Assignment to constant variable")?;
+                return Ok(true);
+            }
+        }
+        self.regs[rd] = self.regs[a];
+        Ok(false)
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_new_object(&mut self, rd: usize) {
+        let proto_ptr = &*self.object_prototype as *const JsObject as *mut JsObject;
+        let obj = self
+            .epoch
+            .alloc(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto_ptr)));
+        self.regs[rd] = JsValue::object(obj as *mut u8);
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_new_array(&mut self, rd: usize, instr: u32) {
+        let proto_ptr = self.session.builtin_world().array_proto.as_ptr() as *mut JsObject;
+        let n = opcode::imm16(instr) as usize;
+        let bump = self.epoch.bump();
+        let obj = self.alloc_object(JsObject::new_array(EMPTY_SHAPE_ID, JsValue::from_js_object(proto_ptr), n, bump));
+        self.regs[rd] = JsValue::object(obj as *mut u8);
+    }
+
+    #[inline(always)]
+    pub(crate) fn dispatch_void(&mut self, rd: usize) {
+        self.regs[rd] = JsValue::undefined();
+    }
 }

crates/oxide_vm/src/dispatch/property.rs

@@ -198,14 +198,14 @@ impl Vm {
 
         if let Some(value) = ic_get_hit(obj, cached_shape_id, cached_slot) {
             self.regs[a] = value;
-            self.ic_hits.set(self.ic_hits.get() + 1);
+            self.profiling.ic_hits.set(self.profiling.ic_hits.get() + 1);
             ic_trace!("IC_GET hit shape={} slot={}", cached_shape_id, cached_slot);
         } else if let Some(template) = self.kernel_core.prop_forge().get_template(obj.shape_id()) {
-            self.ic_misses.set(self.ic_misses.get() + 1);
+            self.profiling.ic_misses.set(self.profiling.ic_misses.get() + 1);
             prop_cache_miss();
             if template.prop_name == prop_name_si {
                 if template.position < obj.prop_vec_len() as u32 {
-                    self.write_ic_back(obj.shape_id(), template.position);
+                    crate::ic_helper::write_ic_back(&mut self.bytecode, self.pc, obj.shape_id(), template.position);
                     ic_debug!(
                         "IC_GET propforge hit shape={} prop={} slot={}",
                         obj.shape_id(),
@@ -226,7 +226,7 @@ impl Vm {
             ic_debug!("IC_GET miss shape={} prop={}", obj.shape_id(), prop_name_si);
             let resolved = self.ordinary_get(obj, prop_name_si, val)?;
             if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), prop_name_si) {
-                self.write_ic_back(obj.shape_id(), pos);
+                crate::ic_helper::write_ic_back(&mut self.bytecode, self.pc, obj.shape_id(), pos);
             }
             self.regs[a] = resolved;
         }
@@ -268,22 +268,22 @@ impl Vm {
         let cached_slot = ext1;
 
         if ic_set_hit(obj, cached_shape_id, cached_slot, value) {
-            self.ic_hits.set(self.ic_hits.get() + 1);
+            self.profiling.ic_hits.set(self.profiling.ic_hits.get() + 1);
             ic_trace!("IC_SET hit shape={} slot={}", cached_shape_id, cached_slot);
         } else if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), prop_name_si) {
-            self.ic_misses.set(self.ic_misses.get() + 1);
+            self.profiling.ic_misses.set(self.profiling.ic_misses.get() + 1);
             prop_cache_miss();
             obj.set_prop_at(pos, value);
-            self.write_ic_back(obj.shape_id(), pos);
+            crate::ic_helper::write_ic_back(&mut self.bytecode, self.pc, obj.shape_id(), pos);
             ic_debug!("IC_SET write-back shape={} slot={}", obj.shape_id(), pos);
         } else {
-            self.ic_misses.set(self.ic_misses.get() + 1);
+            self.profiling.ic_misses.set(self.profiling.ic_misses.get() + 1);
             prop_cache_miss();
             let old_shape = obj.shape_id();
             self.ordinary_set_dispatch(obj, prop_name_si, value, receiver)?;
             if old_shape != obj.shape_id() {
                 if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), prop_name_si) {
-                    self.write_ic_back(obj.shape_id(), pos);
+                    crate::ic_helper::write_ic_back(&mut self.bytecode, self.pc, obj.shape_id(), pos);
                     ic_debug!("IC_SET write-back shape={} slot={}", obj.shape_id(), pos);
                     self.kernel_core.prop_forge().upsert(
                         obj.shape_id(),
@@ -394,3 +394,34 @@ impl Vm {
         Ok(())
     }
 }
+
+impl Vm {
+    pub(crate) fn dispatch_delete_prop_static(&mut self, rd: usize) -> Result<bool, String> {
+        let prop_idx = self.bytecode[self.pc] as usize;
+        self.pc += 1;
+        let key_val = self.immutables().get(prop_idx).copied().unwrap_or_else(JsValue::undefined);
+        let prop_name_si = self.property_key_si(key_val);
+        let Some(obj_ptr) = self.checked_object_ptr(self.regs[rd], "delete on non-object")? else {
+            return Ok(true);
+        };
+        let obj = unsafe { &mut *obj_ptr };
+        if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), prop_name_si) {
+            obj.set_prop_at(pos, JsValue::undefined());
+        }
+        self.regs[rd] = JsValue::bool(true);
+        Ok(false)
+    }
+
+    pub(crate) fn dispatch_delete_prop_dynamic(&mut self, rd: usize, b: usize) -> Result<bool, String> {
+        let prop_name_si = self.property_key_si(self.regs[b]);
+        let Some(obj_ptr) = self.checked_object_ptr(self.regs[rd], "delete on non-object")? else {
+            return Ok(true);
+        };
+        let obj = unsafe { &mut *obj_ptr };
+        if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), prop_name_si) {
+            obj.set_prop_at(pos, JsValue::undefined());
+        }
+        self.regs[rd] = JsValue::bool(true);
+        Ok(false)
+    }
+}