[webkit-changes] [WebKit/WebKit] 7225cf: [JSC] PropertyCondition::isStillValidAssumingImpur...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 7225cf04ea3d003ba0698f620a447be04902fd34
      https://github.com/WebKit/WebKit/commit/7225cf04ea3d003ba0698f620a447be04902fd34
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2023-07-31 (Mon, 31 Jul 2023)

  Changed paths:
    A JSTests/stress/regress-108468977.js
    M Source/JavaScriptCore/bytecode/PropertyCondition.cpp
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/JSObject.h

  Log Message:
  -----------
  [JSC] PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint() should take all put() overrides into account
https://bugs.webkit.org/show_bug.cgi?id=257271
<rdar://108468977>

Reviewed by Yusuke Suzuki.

Currently, PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint() is not taking into account
all existing put() overrides when analyzing side effects of AbsenceOfSetEffect condition, which leads
to incorrect results for e.g. StringObject's "length", which is no-op in sloppy mode yet we rely on
structure being transitioned.

This patch fixes AbsenceOfSetEffect validity check to be more pessimistic when there is overriden put(),
unless it's a common assigment target like JSArray or JSFunction to avoid performance regressions,
all while the helper that checks for special properties with JSObject::definePropertyOnReceiver().

* JSTests/stress/regress-108468977.js: Added.
* Source/JavaScriptCore/bytecode/PropertyCondition.cpp:
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
(JSC::nonStructurePropertyMayBecomeReadOnlyWithoutTransition): Deleted.
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::mightBeSpecialProperty):
(JSC::JSObject::definePropertyOnReceiver):
(JSC::canDefinePropertyOnReceiverFast): Deleted.
* Source/JavaScriptCore/runtime/JSObject.h:

Originally-landed-as: 259548.797 at safari-7615-branch (169a4b7e3f48). rdar://108468977
Canonical link: https://commits.webkit.org/266436@main