[webkit-changes] [WebKit/WebKit] ae0b70: Reflect.construct can churn cached internalFunctio...

[Justin Michaud]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ae0b70efbe6b5326518eef3160144494748d8b11
      https://github.com/WebKit/WebKit/commit/ae0b70efbe6b5326518eef3160144494748d8b11
  Author: Justin Michaud <justin_michaud at apple.com>
  Date:   2023-11-01 (Wed, 01 Nov 2023)

  Changed paths:
    A JSTests/stress/reflect-construct-reenter-prototype-get-different-global.js
    A JSTests/stress/reflect-construct-reenter-prototype-get.js
    M Source/JavaScriptCore/runtime/InternalFunction.cpp

  Log Message:
  -----------
  Reflect.construct can churn cached internalFunctionAllocationStructure
https://bugs.webkit.org/show_bug.cgi?id=263945
rdar://117556294

Reviewed by Keith Miller.
Reviewed by Mark Lam.

Reflect.construct can churn the cached internalFunctionAllocationStructure
when calling the target's prototype getter, causing us to fail a debug assert.
This isn't really a problem though, since accidentally making a second structure
shouldn't break anything (like our watchpoints or structure transition logic).

We just add an extra check to silence the debug assert and be slightly more optimal.

* JSTests/stress/reflect-construct-reenter-prototype-get-different-global.js: Added.
(newTarget):
(get let):
* JSTests/stress/reflect-construct-reenter-prototype-get.js: Added.
(newTarget):
(get let):
* Source/JavaScriptCore/runtime/InternalFunction.cpp:
(JSC::InternalFunction::createSubclassStructure):

Canonical link: https://commits.webkit.org/270084@main