Cherry-pick 65ee808. rdar://127766799

    direct eval operations should use their caller's callee to get the VM
    https://bugs.webkit.org/show_bug.cgi?id=273979
    rdar://127766799

    Reviewed by Yusuke Suzuki.

    Since `eval` could be set to anything, including a non-cell primitive,
    we can't use it get a VM. The caller's frame should have a real callee
    though so we use that instead.

    * JSTests/stress/direct-eval-set-to-42.js: Added.
    (foo):
    (bar):
    * Source/JavaScriptCore/jit/JITOperations.cpp:
    (JSC::JSC_DEFINE_JIT_OPERATION):

    Canonical link: https://commits.webkit.org/278612@main

Canonical link: https://commits.webkit.org/278598.2@safari-7619.1.13-branch

JSTests/stress/direct-eval-set-to-42.js

@@ -0,0 +1,16 @@
+function foo() {
+    try { eval(""); } catch { }
+}
+noInline(foo);
+
+function bar() {
+    "use strict";
+    try { eval(""); } catch { }
+}
+noInline(bar);
+
+eval = 42;
+for (let i = 0; i < 1e5; ++i) {
+    foo();
+    bar();
+}

Source/JavaScriptCore/jit/JITOperations.cpp

@@ -2360,7 +2360,8 @@ JSC_DEFINE_JIT_OPERATION(operationPutByValSetPrivateFieldGeneric, void, (JSGloba
 JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalSloppy, EncodedJSValue, (void* frame, JSScope* callerScopeChain, EncodedJSValue encodedThisValue))
 {
     CallFrame* calleeFrame = reinterpret_cast<CallFrame*>(frame);
-    VM& vm = calleeFrame->deprecatedVM();
+    // We can't trust our callee since it could be garbage but our caller's should be ok.
+    VM& vm = calleeFrame->callerFrame()->deprecatedVM();
     auto scope = DECLARE_THROW_SCOPE(vm);
     calleeFrame->setCodeBlock(nullptr);
 
@@ -2370,7 +2371,8 @@ JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalSloppy, EncodedJSValue, (void* f
 JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalStrict, EncodedJSValue, (void* frame, JSScope* callerScopeChain, EncodedJSValue encodedThisValue))
 {
     CallFrame* calleeFrame = reinterpret_cast<CallFrame*>(frame);
-    VM& vm = calleeFrame->deprecatedVM();
+    // We can't trust our callee since it could be garbage but our caller's should be ok.
+    VM& vm = calleeFrame->callerFrame()->deprecatedVM();
     auto scope = DECLARE_THROW_SCOPE(vm);
     calleeFrame->setCodeBlock(nullptr);