[webkit-changes] [WebKit/WebKit] 0bcb04: [JSC] Remove ReflectSet PutPropertySlot context

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0bcb041d293c3589cb6096b08e29dd9981e0f0e6
      https://github.com/WebKit/WebKit/commit/0bcb041d293c3589cb6096b08e29dd9981e0f0e6
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-05-25 (Thu, 25 May 2023)

  Changed paths:
    M JSTests/stress/custom-get-set-inline-caching-one-level-up-proto-chain.js
    M JSTests/stress/custom-get-set-proto-chain-put.js
    A JSTests/stress/multiline-error.js
    M JSTests/stress/poly-proto-custom-value-and-accessor.js
    M JSTests/stress/put-to-primitive-non-reified-static-custom.js
    M JSTests/stress/static-put-in-prototype-chain.js
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/PutPropertySlot.h
    M Source/JavaScriptCore/runtime/ReflectObject.cpp

  Log Message:
  -----------
  [JSC] Remove ReflectSet PutPropertySlot context
https://bugs.webkit.org/show_bug.cgi?id=257293
rdar://108261050

Reviewed by Alexey Shvayka.

ReflectSet Context is almost always wrong. There are ways to alter |this| with receiver (e.g. `super.prop`).
So this patch removes it. We also stop calling CustomValue setter for altered |this|, since it is value, not accessor.

* JSTests/stress/multiline-error.js: Added.
(foo):
(C):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::putInlineSlow):
(JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded):
* Source/JavaScriptCore/runtime/PutPropertySlot.h:
* Source/JavaScriptCore/runtime/ReflectObject.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/264520@main