Bug 280576 – Object.assign doesn't handle modified self-assignment properly

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[GuY]

```
for (let i = 0; i < 5; i++) {
  function CLS(value) {
    this.prop = value;
  }
  const a = new CLS(5);
  const b = new CLS(6);
  Object.assign(a, b, a);
  print(a.prop)
}
```
run args:
./WebKitBuild/JSCOnly/Debug/bin/jsc test.js --useConcurrentJIT=0

actual output:
6
6
5
5
5

tested in the latest webkit main branch 81b0097021b1003a3942a1b470bf750a846e3b45

[Sosuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/34449

[EWS]

Committed 284486@main (d66fa25fde99): <https://commits.webkit.org/284486@main>

Reviewed commits have been landed. Closing PR #34449 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/137040490>