[JSC] MapIterator / SetIterator should be handled in DFG

300fd8c

// Source/JavaScriptCore/builtins/MapIteratorPrototype.js: Removed.
// Source/JavaScriptCore/builtins/SetIteratorPrototype.js: Removed.
+ JSC::VM::fastMapKeysSentinel
+ JSC::VM::fastMapValuesSentinel
+ JSC::VM::fastSetEntriesSentinel
+ JSC::iteratorOpenTryFastImpl
+ JSC::iteratorNextTryFastImpl

JSC's DFG performs speculative optimizations based on observed types. 'Handling an iterator in DFG' means emitting IteratorOpen and IteratorNext IR nodes that lower directly to C++ fast-path calls instead of dispatching through JS function call machinery. The fast path is protected by watchpoints — weak references that fire and trigger OSR-exit when guarded objects (here, MapIteratorPrototype.next or Map.prototype[@@iterator]) are modified.

This commit moves MapIterator#next() and SetIterator#next() from builtin JavaScript to C++ and wires all six Map/Set iteration methods into DFG as first-class fast paths. The VM now carries three new sentinel values (fastMapKeysSentinel, fastMapValuesSentinel, fastSetEntriesSentinel) used to distinguish iteration modes. Previously next() ran through JS-level safety guarantees; moving to C++ with DFG integration eliminates that safety net — the C++ implementation must manually uphold every invariant the JS version got for free.

Significance

This is a large-surface JIT fast-path addition: new C++ iterator state machines, new DFG IR nodes, new watchpoint guards, and new cross-realm checks all land at once. Every layer is a potential source of type confusion, lifetime bugs, or guard-bypass.

Audit directions

• Watchpoint coverage. The stress tests cover map-iterator-fast-watchpoint-invalidate-next.js and *-invalidate-symbol-iterator.js. These guard two separate prototype slots. Probe whether additional prototype slots or prototype-chain positions can be modified without triggering either watchpoint — particularly in cross-realm scenarios where the iterator's prototype chain may differ from the guarded objects.
• Cross-realm fast path. The *-cross-realm.js tests exist because realm identity checks are required. DFG type checks are structure-based, not realm-based by default; verify the fast path correctly bails when the iterator's structure belongs to a different global object.
• Mid-iteration Map/Set mutation. The C++ fast path advances an internal index into the backing storage. If the Map is structurally modified (add/delete) between IteratorNext calls while DFG has speculated on its structure, check whether index bookkeeping can go out of bounds or alias a deleted entry.
• VM sentinel identity. The three new VM-pinned sentinels are mode tags used by pointer identity. If the fast path distinguishes modes by pointer identity, investigate whether any path can supply an equivalent object that bypasses the identity check and confuses mode selection.
• OSR-exit safety. When DFG deoptimizes mid-loop due to watchpoint invalidation, the interpreter must reconstruct iterator state from the DFG frame. Verify all iterator internal fields (index, done flag, backing storage pointer) are correctly materialized on OSR-exit, especially between IteratorOpen and the first IteratorNext.

---