Bug 285179 – [JSC] Retry with SlowPutArrayStorage properly

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[EntryHi]

Hello, I found a bug in JavaScriptCore.

The PoC is shown as below:
========================poc.js============
class C31 {
  constructor(a33) {
    a33[536870912] = 2;
    for (const v38 in a33) {
      print(v38);
    }
  }
}
Object.defineProperty(C31.__proto__, 536870912, { enumerable: true, value: {}});
new C31(C31);
new C31(C31);
new C31(C31);
new C31(Map);
========================================

Reproduce bug:
Step 1: ./jsc poc.js --useConcurrentJIT=0  --jitPolicyScale=0
Step 2: ./jsc poc.js --useConcurrentJIT=0  --jitPolicyScale=1

The result of Step 1:
536870912
536870912
536870912
Exception: TypeError: Attempted to assign to readonly property.
[e-mail]:3:8
global [e-mail]:13:8


The result of Step 2:
536870912
536870912
536870912
536870912

V8 throw an exception in the first new operation which is also diffrent from that in Step 1 or Step 2.

[Radar WebKit Bug Importer]

<rdar://problem/142297349>

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/39034

[EWS]

Committed 288905@main (5aa0914c99ba): <https://commits.webkit.org/288905@main>

Reviewed commits have been landed. Closing PR #39034 and removing active labels.