Unreviewed, reverting 275836@main.

https://bugs.webkit.org/show_bug.cgi?id=270746

Large JS2 / JS3 regression

Reverted changeset:

"Add runtime flag to allow JIT Cage experiments"
https://bugs.webkit.org/show_bug.cgi?id=270668
https://commits.webkit.org/275836@main

Canonical link: https://commits.webkit.org/275878@main

Source/JavaScriptCore/runtime/Options.cpp

@@ -1375,12 +1375,6 @@ SUPPRESS_ASAN bool canUseJITCage()
 {
     if (JSC_FORCE_USE_JIT_CAGE)
         return true;
-#if PLATFORM(MAC)
-    if (Options::allowJITCageExperiments()) {
-        RELEASE_ASSERT(JSC_JIT_CAGE_VERSION());
-        return true;
-    }
-#endif // PLATFORM(MAC)
     return JSC_JIT_CAGE_VERSION() && WTF::processHasEntitlement("com.apple.private.verified-jit"_s);
 }
 #else

Source/JavaScriptCore/runtime/OptionsList.h

@@ -554,7 +554,6 @@ bool canUseHandlerIC();
     v(Unsigned, seedForLICMFuzzer, 424242, Normal, nullptr) \
     v(Double, allowHoistingLICMProbability, 0.5, Normal, nullptr) \
     v(Bool, exposeCustomSettersOnGlobalObjectForTesting, false, Normal, nullptr) \
-    v(Bool, allowJITCageExperiments, false, Normal, nullptr) \
     v(Bool, useJITCage, canUseJITCage(), Normal, nullptr) \
     v(Bool, useAllocationProfiling, false, Normal, "Allows toggling of bmalloc/libPAS allocation profiling features at JSC launch.") \
     v(Bool, dumpBaselineJITSizeStatistics, false, Normal, nullptr) \

Source/WTF/wtf/PlatformEnable.h

@@ -896,7 +896,7 @@
 #define ENABLE_GC_VALIDATION 1
 #endif
 
-#if OS(DARWIN) && ENABLE(JIT) && USE(APPLE_INTERNAL_SDK) && CPU(ARM64E) && HAVE(JIT_CAGE)
+#if OS(DARWIN) && ENABLE(JIT) && USE(APPLE_INTERNAL_SDK) && CPU(ARM64E) && HAVE(JIT_CAGE) && !PLATFORM(MAC)
 #define ENABLE_JIT_CAGE 1
 #endif