tree 031aa8b48f82dcfb05ade5a49d9c3cd5c2838bdb
parent c11507b158b7324dfc84eb3c11183473574bc02b
author ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571082868 +0000
committer ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571082868 +0000

[JSC] GetterSetter should be JSCell, not JSObject
https://bugs.webkit.org/show_bug.cgi?id=202656

Reviewed by Tadeu Zagallo and Saam Barati.

JSTests:

* stress/getter-setter-should-be-cell.js: Added.
(foo.with.):
(foo.with.get for):
(foo.with.bar):
(foo):

Source/JavaScriptCore:

Essentially, GetterSetter is not a JSObject. It is like a JSCell. But we made GetterSetter JSObject
to leverage existing strict-eq implementations for JSObject: pointer-comparison. But given the following
conditions,

1. GetterSetter strict-eq comparison only happens in builtin code when using @tryGetById.
2. RHS of that comparison is always folded into constant in DFG.
3. We already use pointer-comparison for cells that are neither JSString nor JSBigInt.
4. DFG strength reduction already has a rule which makes `CompareStrictEq(Cell-not-JSString/JSBigInt, Constant)` `ComparePtrEq`.

So we already support non-JSString/JSBigInt cell comparison in JSC JS code. We should use it instead of making GetterSetter JSObject.
This patch makes GetterSetter JSCell, and makes getterSetterStructure per-VM structure.

The attached test reported AI validation failure. AI assumed that GetterSetter's realm should be the same to the base object. But
this is incorrect in our runtime code: we are creating GetterSetter with lexical realm (JSGlobalObject). But the fundamental problem
is that GetterSetter is JSObject and tied to JSGlobalObject while it is not necessary.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGFixupPhase.cpp:
* runtime/GetterSetter.cpp:
* runtime/GetterSetter.h:
* runtime/JSGlobalObject.cpp:
(JSC::getGetterById):
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::regExpProtoGlobalGetter const):
(JSC::JSGlobalObject::regExpProtoUnicodeGetter const):
(JSC::JSGlobalObject::customGetterSetterFunctionStructure const):
(JSC::JSGlobalObject::getterSetterStructure const): Deleted.
* runtime/JSType.h:
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251088 268f45cc-cd09-0410-ab3c-d52691b4dbfc