tree dd15187b296f043f9c4c0891fc22a248b29bc40e
parent 1ec4c986e03fe320026d1f7632fd64003b7b9052
author shvaikalesh@gmail.com <shvaikalesh@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1655411858 +0000
committer shvaikalesh@gmail.com <shvaikalesh@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1655411858 +0000

AbsenceOfSetEffect property condition should mind put() overrides
https://bugs.webkit.org/show_bug.cgi?id=241574
<rdar://91833733>

Reviewed by Yusuke Suzuki.

Since JSArray's "length" and RegExpObject's "lastIndex" may be reconfigured as non-writable,
we need to handle them separately in AbsenceOfSetEffect property condition to ensure that compiler
takes a slow path in that case, following the spec and throwing an exception in strict mode [1].

I'm not sure how to make a test case capturing this though.

[1]: https://tc39.es/ecma262/#sec-ordinarysetwithowndescriptor (step 2.a)

* Source/JavaScriptCore/bytecode/PropertyCondition.cpp:
(JSC::nonStructurePropertyMayBecomeReadOnlyWithoutTransition):
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):

Canonical link: https://commits.webkit.org/251615@main


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@295610 268f45cc-cd09-0410-ab3c-d52691b4dbfc