JSPromise: inline reaction storage for single-handler .then(f)

3f9955f

JSTests/stress/promise-inline-child-reaction.js

+// PATH 1 — inline-child: single .then(f), no allocation
+{
+    let d = defer();
+    let q = d.promise.then(v => { counter++; return v + 1; });
+    d.resolve(10);
+    shouldBe(await q, 11);
+}
+// PATH 2 — spill: second .then() converts inline storage to reaction list
+{
+    let d = defer();
+    let a = d.promise.then(v => v * 2);
+    let b = d.promise.then(v => v * 3); // triggers spillInlineReaction
+    let c = d.promise.then(v => v * 4);
+}
+// PATH 3 — two-arg .then(f,g): falls through to JSFullPromiseReaction, no inline

JSPromise previously subclassed JSInternalFieldObjectImpl, storing state and reactions as JSValues in a fixed internal-fields array shared with WeakRef, FinalizationRegistry, and similar objects. Every .then() call allocated a separate JSPromiseReaction cell holding the callback and child-promise pointer, even when only one handler ever fires. This commit reworks JSPromise into a plain JSObject with a CompactPointerTuple member packing the first reaction's handler (or microtask context) alongside flag bits in one machine word; a second .then() triggers spillInlineReaction which promotes the inline cell to a JSSlimPromiseReaction linked list. New DFG nodes NewPromise and PhantomNewPromise mirror how JSFunction participates in allocation sinking, with PhantomNewPromise reconstructing the promise on OSR exit.

Before — every .then():
  JSPromise [JSInternalFieldObjectImpl]
    internalFields[1]: reactions ─► JSPromiseReaction (heap cell)

After — first .then(f) [no allocation]:
  JSPromise [JSObject]
    packed: CompactPointerTuple
              cell ─► fulfillHandler (JSFunction*)
              bits: InlineHandler flag

After — second .then() spills:
  JSPromise [JSObject]
    packed: CompactPointerTuple
              cell ─► JSSlimPromiseReaction ─► JSSlimPromiseReaction

Significance

Eliminating the per-.then() JSPromiseReaction allocation removes heap pressure across every Promise-heavy workload and rewires the entire JSPromise object model in the process. Switching from JSInternalFieldObjectImpl to plain JSObject means the GC is no longer auto-visiting an internal-fields array; the CompactPointerTuple's cell pointer must now be visited by an explicit visitChildrenImpl. New IR nodes (NewPromise, PhantomNewPromise) participate in scalar replacement and OSR-exit materialization.

Audit directions

CompactPointerTuple type confusion in the inline reaction slot. The packed field stores a raw JSCell* alongside bit flags in one word. Code that reads the cell without first checking inlineReactionKind() could interpret a bare JSFunction handler as a JSSlimPromiseReaction head, or vice versa. The flag-masking logic in payloadCell() and setPackedCell() is the critical gate; verify every consumer of packedCell() consults the kind before dispatching.
Spill-path GC interaction. spillInlineReaction() must atomically promote the inline cell to a heap-allocated list node. If a GC fires between reading the old inline cell and writing the new list head, the inline cell could be collected before being rooted in the new JSSlimPromiseReaction. Cross-reference promise-packed-layout-gc-stress.js which targets exactly this window.
visitChildrenImpl coverage in transient states. Moving from JSInternalFieldObjectImpl (GC visits internal fields automatically) to explicit visitChildrenImpl() means any transient state between setPackedCell() calls where the inline handler or child promise is reachable but not yet visited is a UAF surface.
PhantomNewPromise OSR-exit materialization. The mapping between phantom fields and the real JSPromise layout (flags word, packed CompactPointerTuple) must be exact. A field-offset mismatch during reconstruction produces a live JSPromise with corrupt flags or a dangling cell pointer, exploitable from JS once the promise is settled.
settleInlineInternalMicrotask vs. settleInlineHandler dispatch. Two settler functions share the same CompactPointerTuple storage but differ in semantics. Incorrect flag masking in inlineReactionKind() could dispatch to the wrong settler, firing the wrong callback or double-settling a promise.