839474 - Need to assert somewhere that we don't break code that uses getFixedSlotOffset when we do a JSObject::swap

Status: NEW

(Core :: JavaScript Engine, enhancement, P3)

Description

[Boris Zbarsky [:bzbarsky]]

It looks like JSObject::swap can lead to situations in which an object has some non-fixed reserved slots, if the classes of the objects being swapped have different numbers of reserved slots.

We don't have that many uses of getFixedSlotOffset in our tree, though.  The main ones I can think of that are relevant here are in ion's CodeGenerator::visitGetDOMProperty/visitSetDOMProperty/visitCallDOMNative and those only care about reserved slot 0 being a fixed slot, which is true for both DOM objects and anything they'll swap() with (i.e. proxies), so should always work.  We just need to assert about this ... somewhere. Not sure where.

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

I think it's certainly possible we could still improve the assertions in JSObject::swap