[JSC] A store decided from the Structure alone calls the put() or defineOwnProperty() override of the class

[robobun]

Problem

• Three JSC paths store to a property from the Structure alone and skip a put() or defineOwnProperty() override: the DFG's PutByStatus::computeFor(StructureSet) (bytecode/PutByStatus.cpp:364), the for-in store (op_enumerator_put_by_val) and the JSON.parse reviver walk.
• In Bun, process.env.TZ = zone from a hot function stops changing the time zone (call 108 stored Asia/Tokyo offset 0).
• The DFG abstract interpreter trusts the same status. A PutById that it keeps counts as free of side effects, so a later load returns another property's value.

Fix

• Structure gets one bit, classInterceptsOwnPropertyStores: the class overrides put() or defineOwnProperty(), and not getOwnPropertySlot().
• PutByStatus returns LikelyTakesSlowPath for it (the gate from [JSC] A store to Error.stackTraceLimit from JIT code keeps updating the stack trace limit #640). The five copies of the for-in store test one named mask that includes it. The reviver walk calls createDataProperty().
• Verified: three new JSTests/stress tests. Fork main fails 50 of 51 runs (17 modes each), this branch none. Each of the 7 hunks, reverted alone, fails one test.

Background

• An inline cache asks the PutPropertySlot if it can cache a store. These paths have no slot.
• Considered the [JSC] A store to Error.stackTraceLimit from JIT code keeps updating the stack trace limit #640 gate alone: one path of three. Considered ProhibitsPropertyCaching on Bun's process.env and require.extensions: it turns off their read caches and leaves two paths.

Downsides

• Structure creation: +20 instructions in the creating constructor (149 to 169), +5 in the transition constructor (objdump, x64 release).
• JSON.parse with a reviver: +6 instructions per revived property.
• Plain objects get 0 new instructions per store and per for-in iteration. A hot process.env store now calls put() each time.

Notes

Repro in jsc ($vm.createObjectDoingSideEffectPutWithCorrectSlotStatus() is new in this PR: put() and defineOwnProperty() convert the value to a string, and put() calls slot.disableCaching()):

var object = $vm.createObjectDoingSideEffectPutWithCorrectSlotStatus();
object.x = 0;
function store(v) { object.x = v; }
function load() { return object.x; }
noInline(store); noInline(load);
for (var i = 0; i < 100000; ++i) { store(i); if (load() !== String(i)) throw new Error("iteration " + i + ": " + typeof object.x); }

Fork main throws at iteration 99 with --useConcurrentJIT=0. It passes with --useDFGJIT=0, --useAccessInlining=0 or --useJIT=0.

Repro in Bun (release 1.4.3-canary.1, Node v26.3.0 prints nothing):

function setTZ(zone) { process.env.TZ = zone; }
function readTZ() { return process.env.TZ; }
for (let i = 0; i < 20000; i++) {
  const zone = i & 1 ? "UTC" : "Asia/Tokyo";
  setTZ(zone); readTZ();
  const off = new Date(2020, 0, 1).getTimezoneOffset();
  if (off !== (i & 1 ? 0 : -540)) { console.log("call", i, "stored", process.env.TZ, "offset", off); break; }
}

How each path gets to the raw store

• DFG, Replace: the base has a proved structure (a constant, or a load before the store). A load of the same property from JIT code creates the replacement watchpoint set, and the next store fires it. computeFor then returns a Replace variant and tryFoldAsPutByOffset emits PutByOffset.
• DFG, Transition: a store that adds a property needs no watchpoint set, only a proved structure and an existing transition.
• DFG, two structures with the property at two offsets: the FTL emits MultiPutByOffset. The DFG tier keeps the PutById, but the abstract interpreter already called didFoldClobberWorld(). put() runs toString() on the value, that code changes another object, and a later GetByOffset on that object has lost its CheckStructure. The test gets "q" where undefined is correct.
• DFG, direct store (class field): the slow path calls defineOwnProperty() when the class overrides it (CommonSlowPaths::canPutDirectFast). The fold skipped it.
• For-in store: for (name in object) object[name] = value writes the slot when the structure matches the enumerator and has none of two bits. This happens in the LLInt already, so --useJIT=0 fails too.
• Reviver walk: the reviver can put any object in the tree, and the walk then stores the revived value with putDirectOffset.

The bit

• Definition: the cell is an object, the class does not set OverridesGetOwnPropertySlot, and it sets OverridesPut or its method table has a defineOwnProperty other than JSObject::defineOwnProperty.
• A class that also overrides getOwnPropertySlot() (JSArray, JSFunction, RegExpObject, ErrorInstance, arguments, the global object) is as before. PutByStatus has its own test for that flag, with the global object exempt. The put() of those classes guards names that a for-in store does not reach.
• A temporary log over 8,824 JSTests scripts (stress, wasm, es6, microbenchmarks) printed only the two $vm classes.
• sizeof(Structure) is 112 bytes before and after (x64). Bit 11 of m_bitField was free. [JSC] JSObject::makePropertiesImmutable(): an object's own properties and prototype stop changing, and its property attributes stay as they are #759 uses bit 10.

Verification (Linux x64)

• The head (2d86805, after the rebase onto [JSC] JSObject::makePropertiesImmutable(): an object's own properties and prototype stop changing, and its property attributes stay as they are #759): CI builds every lane, and the JSC test jobs on Linux x64 and arm64 pass (x64: 120,000 test runs, 0 failed). The jsc of the preview build passes the three new tests in 51 of 51 runs of run-jsc-stress-tests.
• Bun, debug and ASAN build of process: let inline caches work on process.env and process.argv bun#44356 merged with main, against the preview build of this PR: the it.todo script of that PR stores 0 raw values of 300,000 (299,390 with the pinned WebKit) and the test passes as an it. The TZ loop above is correct for all 20,000 calls. A for-in store over a Worker's process.env leaves 0 raw values of 3 (3 before). A for-in store over require.extensions calls the hook (0 calls before). A JSON.parse reviver that puts process.env in the tree gets a string stored (a number before). NODE_TLS_REJECT_UNAUTHORIZED set from a hot function changes what fetch does again. test/js/node/process/process.test.js: 189 pass, 5 skip, and 1 failure because USER is not set in my container.
• I measured everything below on 6ee4f72, the commit before the rebase onto [JSC] JSObject::makePropertiesImmutable(): an object's own properties and prototype stop changing, and its property attributes stay as they are #759. The rebase adds the bit of [JSC] JSObject::makePropertiesImmutable(): an object's own properties and prototype stop changing, and its property attributes stay as they are #759 to the named mask and joins the two conditions in the reviver walk.
• run-jsc-stress-tests on the three new tests, release build: fork main plus the test class fails 50 of 51 runs (the DFG test passes only in lockdown, which has no JIT). This branch passes 51 of 51.
• Each hunk reverted alone: the FTL, DFG, Baseline, LLInt and C++ copies of the for-in store each make enumerator-put-by-val-calls-put-override.js fail, the reviver guard makes json-parse-reviver-calls-define-own-property-override.js fail, and the PutByStatus gate makes put-override-is-called-when-dfg-proves-structure.js fail.
• The tests of JSTests/stress whose name matches put-by|for-in|forin|enumerator|json|class-field|define-field|object-assign|multi-put|reviver|incorrect-put|put-override, all modes, release build: 4,280 runs, 0 failures.
• Debug build (assertions on): the existing $vm.createObjectDoingSideEffectPutWithoutCorrectSlotStatus tests that run in a debug build, the enumerator and reviver tests, and the new ones. 249 runs, 0 failures.

Cost measurements (release jsc, fork main plus the test class against this branch)

• For-in store on a plain object: LLIntAssembly.h differs in the immediate at 3 sites (testl $262160, 16(%rdx) to testl $264208, 16(%rdx)). Baseline, DFG and FTL code for function f(o) { for (var k in o) o[k] = 1; } has the same size in both builds (1120, 1184 and 1472 bytes). The debug disassembly differs in that immediate only (testl $0x40010 to testl $0x40810).
• PutById on a plain object with a cached load: same DFG graph, same code size (416 bytes), still PutByOffset.
• For-in store over named properties of an Array, a function and a RegExp (36,000 stores, --useJIT=0, gdb breakpoint on slow_path_enumerator_put_by_val): 12,000 hits before and after. A plain object: 0 hits before and after.
• size jsc (both built in the same directory): text 43952121 to 43951353, total 44732804 to 44732804.
• arm64 was not run here. Neither mask is an ARM64 logical immediate, so both take the same move and tst sequence.
• perf, valgrind and bloaty are not installed on the machine, so the instruction counts come from objdump and from the JIT dumps.

Not in this PR

• Bun side, after this merges: bump WEBKIT_VERSION, call slot.disableCaching() in JSCommonJSExtensions::put, and add the Bun tests. process: let inline caches work on process.env and process.argv bun#44356 gives process.env its own slot in put() and has an it.todo for the DFG fold.
• Integer-like keys (process.env[700] = 1) use putByIndex and indexed storage. That is a different hook.
• A class that overrides both put() and getOwnPropertySlot() keeps the for-in store and the reviver store as they are. JSCallbackObject is such a class.
• [JSC] JSObject::makePropertiesImmutable(): an object's own properties and prototype stop changing, and its property attributes stay as they are #759 merged first. It edits the same five mask lines, the reviver condition and the PutByStatus gate. The named mask now holds its bit too.

[robobun]

How I reproduced it:

• Bun release 1.4.3-canary.1 on Linux x64: the setTZ / readTZ loop from the Notes prints call 108 stored Asia/Tokyo offset 0. Node v26.3.0 prints nothing. BUN_JSC_useDFGJIT=0 or BUN_JSC_useAccessInlining=0 prints nothing.
• jsc built from fork main 4fde158 plus the $vm test class of this PR: the three new tests in JSTests/stress throw (50 of 51 runs of run-jsc-stress-tests). Built from this branch: 51 of 51 pass.
• Bun debug build of process: let inline caches work on process.env and process.argv bun#44356 merged with main: its it.todo script prints 299390 with the pinned WebKit and 0 with the preview build of this PR.

This PR: #764

[github-actions]

Preview build of 2d86805: autobuild-preview-pr-764-2d868053