REGRESSION(268480@main): test/language/arguments-object/S10.6_A5_T3.j…

…s test262 test is failing

https://bugs.webkit.org/show_bug.cgi?id=262315
rdar://116187196

Reviewed by Yusuke Suzuki.

Previously, we introduced a fast path for getting `arguments.length`
by retrieving `argumentCountIncludingThis` from CallFrame (268480@main).
However, we should disable the fast path when `delete arguments.length`
since it modifies `arguments`.

* JSTests/stress/get-arguments-length-fast.js:
(deleteArgumentsLength):
* Source/JavaScriptCore/parser/ASTBuilder.h:
(JSC::ASTBuilder::makeDeleteNode):

Canonical link: https://commits.webkit.org/268601@main

JSTests/stress/get-arguments-length-fast.js

@@ -300,3 +300,9 @@ shouldBeAsync(14, () => argumentsWithAsyncFunction(1, 2, 3));
     var arguments = [3, 2];
     shouldBe(arguments.length, 2);
 }
+
+function deleteArgumentsLength() {
+    return (delete arguments.length);
+}
+
+shouldBe(deleteArgumentsLength(), true);

Source/JavaScriptCore/parser/ASTBuilder.h

@@ -1237,6 +1237,7 @@ ExpressionNode* ASTBuilder::makeDeleteNode(const JSTokenLocation& location, Expr
         return new (m_parserArena) DeleteBracketNode(location, bracket->base(), bracket->subscript(), divot, start, end);
     }
     ASSERT(expr->isDotAccessorNode());
+    checkArgumentsLengthModification(expr);
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
     return new (m_parserArena) DeleteDotNode(location, dot->base(), dot->identifier(), divot, start, end);
 }