Bug 200386 – JSObject::putInlineSlow should not ignore "__proto__" for Proxy

• Component: JavaScriptCore
• Status: RESOLVED FIXED

poc.js
```
let map = new Map();
function v5() {
    function v10() {
        function v11() {
            const v12 = v5();
            return null;
        }
        const handler = { getPrototypeOf:v11 };
        const p = new Proxy(map,handler);
        map.__proto__ = p;
        const v16 = v10();
    }
    try {
        const v17 = v10();
    } catch(e) {
        //print(e);
    }
}
const v19 = v5();
```

execution result:
ASSERTION FAILED: baseValue.asCell()->structure(vm) == structure
../../Source/JavaScriptCore/jit/Repatch.cpp(468) : JSC::InlineCacheAction JSC::tryCachePutByID(JSC::ExecState *, JSC::JSValue, JSC::Structure *, const JSC::Identifier &, const JSC::PutPropertySlot &, JSC::StructureStubInfo &, JSC::PutKind)
[1]    17017 abort (core dumped)  /media/hdd/WebKit-git/webkit_build_825bbd0_20190704/Debug/bin/jsc

[Radar WebKit Bug Importer]

<rdar://problem/53854946>

[Saam Barati]

patch forthcoming

[Saam Barati]

Created attachment 378698 [details]
patch

[Yusuke Suzuki]

Comment on attachment 378698 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=378698&action=review

r=me

> Source/JavaScriptCore/runtime/JSObject.cpp:841
> +        if (obj->type() == ProxyObjectType) {

Can you fix ordinarySetSlow too?

[Saam Barati]

(In reply to Yusuke Suzuki from comment #4)
> Comment on attachment 378698 [details]
> patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=378698&action=review
> 
> r=me
> 
> > Source/JavaScriptCore/runtime/JSObject.cpp:841
> > +        if (obj->type() == ProxyObjectType) {
> 
> Can you fix ordinarySetSlow too?

Good call. Fixed and added a test

[Saam Barati]

Created attachment 378700 [details]
patch for landing

[EWS Watchlist]

Comment on attachment 378700 [details]
patch for landing

Attachment 378700 [details] did not pass jsc-ews (mac):
Output: https://webkit-queues.webkit.org/results/13027855

New failing tests:
mozilla-tests.yaml/js1_5/Array/regress-101964.js.mozilla-ftl-eager-no-cjit-validate-phases

[Saam Barati]

The test is flaky. It's not this patch

[WebKit Commit Bot]

Comment on attachment 378700 [details]
patch for landing

Clearing flags on attachment: 378700

Committed r249911: <https://trac.webkit.org/changeset/249911>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Yusuke Suzuki]

*** Bug 202342 has been marked as a duplicate of this bug. ***

[Yusuke Suzuki]

*** Bug 202624 has been marked as a duplicate of this bug. ***