[JSC] EnumeratorNextUpdateIndexAndMode should require the original array structure before using InBoundsSaneChain

https://bugs.webkit.org/show_bug.cgi?id=320620

Reviewed by Yusuke Suzuki and Keith Miller.

The sane-chain speculation for the indexed enumerator mode was guarded
only by benefitsFromOriginalArray(), which checks the indexing type but
not the array class. As a result an array with a custom prototype got
InBoundsSaneChain and DFG/FTL skipped hole checks against the prototype,
diverging from LLInt/baseline. Check isJSArrayWithOriginalStructure()
first, like every other sane-chain site in fixup does.

Test: JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js

* JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js: Added.
(shouldBe):
(mutate):
(test):
(makeArray):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

Canonical link: https://commits.webkit.org/318293@main

Author: sosukesuzuki

JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js

@@ -0,0 +1,37 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + " expected: " + expected);
+}
+
+function mutate(array, proto, key, doMutate) {
+    if (doMutate && key === "1") {
+        delete array[3];
+        proto[3] = "inherited";
+    }
+}
+noInline(mutate);
+
+function test(array, proto, doMutate) {
+    var keys = [];
+    for (var key in array) {
+        keys.push(key);
+        mutate(array, proto, key, doMutate);
+    }
+    return keys.join(",");
+}
+noInline(test);
+
+function makeArray() {
+    var proto = {};
+    var array = [1, 2, 3, 4, 5];
+    Object.setPrototypeOf(array, proto);
+    return [array, proto];
+}
+
+for (var i = 0; i < testLoopCount; i++) {
+    var [array, proto] = makeArray();
+    shouldBe(test(array, proto, false), "0,1,2,3,4");
+}
+
+var [array, proto] = makeArray();
+shouldBe(test(array, proto, true), "0,1,2,3,4");

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -3058,7 +3058,7 @@ class FixupPhase : public Phase {
                 blessArrayOperation(base, index, storageEdge);
 
                 ArrayMode arrayMode = node->arrayMode();
-                if (arrayMode.benefitsFromOriginalArray())
+                if (arrayMode.isJSArrayWithOriginalStructure() && arrayMode.benefitsFromOriginalArray())
                     setSaneChainIfPossible(node, arrayMode.speculation() == Array::InBounds ? Array::InBoundsSaneChain : Array::OutOfBoundsSaneChain);
             }