fix(engine): don't cache a slot when the access changed the object's shape

core/engine/src/vm/inline_cache/tests.rs

@@ -1,15 +1,18 @@
 use boa_gc::Gc;
+use boa_macros::js_str;
 use boa_parser::Source;
+use indoc::indoc;
 
 use crate::{
-    Context, JsObject, JsResult, JsValue,
+    Context, JsObject, JsResult, JsValue, TestAction,
     builtins::{OrdinaryObject, function::OrdinaryFunction},
     js_string,
     object::{
         ObjectInitializer, internal_methods::InternalMethodPropertyContext,
         shape::slot::SlotAttributes,
     },
     property::{Attribute, PropertyDescriptor, PropertyKey},
+    run_test_actions,
     vm::CodeBlock,
 };
 
@@ -465,3 +468,50 @@ fn test_megamorphic_inline_cache() -> JsResult<()> {
 
     Ok(())
 }
+
+#[test]
+fn prototype_getter_that_shadows_itself_runs_once() {
+    run_test_actions([TestAction::assert_eq(
+        indoc! {r#"
+            var loads = 0;
+            var proto = {};
+            Object.defineProperty(proto, 'value', {
+                get: function() {
+                    loads++;
+                    Object.defineProperty(this, 'value', { value: 42, writable: true });
+                    return this.value;
+                }
+            });
+            function getValue(obj) { return obj.value; }
+            var obj = Object.create(proto);
+            getValue(obj);
+            getValue(obj);
+            getValue(obj);
+            loads;
+        "#},
+        1,
+    )]);
+}
+
+#[test]
+fn prototype_setter_that_shadows_itself_runs_once() {
+    run_test_actions([TestAction::assert_eq(
+        indoc! {r#"
+            var stores = 0;
+            var proto = {};
+            Object.defineProperty(proto, 'value', {
+                set: function(value) {
+                    stores++;
+                    Object.defineProperty(this, 'value', { value: value, writable: true });
+                }
+            });
+            function setValue(obj, value) { obj.value = value; }
+            var obj = Object.create(proto);
+            setValue(obj, 1);
+            setValue(obj, 2);
+            setValue(obj, 3);
+            [stores, obj.value].join();
+        "#},
+        js_str!("1,3"),
+    )]);
+}

core/engine/src/vm/opcode/get/property.rs

@@ -62,17 +62,17 @@ fn get_by_name<const LENGTH: bool>(
     drop(object_borrowed);
 
     let key: PropertyKey = ic.name.clone().into();
+    let shape = object.borrow().shape().clone();
 
     let context = &mut InternalMethodPropertyContext::new(context);
     let result = object.__get__(&key, receiver.clone(), context)?;
 
-    // Cache the property.
+    // Cache the property, unless the get changed the object's shape (e.g. a getter that defines
+    // an own property): the slot was looked up in the previous shape.
     let slot = *context.slot();
-    if slot.is_cacheable() {
+    if slot.is_cacheable() && object.borrow().shape().to_addr_usize() == shape.to_addr_usize() {
         let ic = &context.vm.frame().code_block.ic[usize::from(index)];
-        let object_borrowed = object.borrow();
-        let shape = object_borrowed.shape();
-        ic.set(shape, slot);
+        ic.set(&shape, slot);
     }
 
     context.vm.set_register(dst.into(), result);

core/engine/src/vm/opcode/set/property.rs

@@ -62,6 +62,7 @@ fn set_by_name(
     drop(object_borrowed);
 
     let name: PropertyKey = ic.name.clone().into();
+    let shape = object.borrow().shape().clone();
 
     let context = &mut InternalMethodPropertyContext::new(context);
     let succeeded = object.__set__(name.clone(), value.clone(), receiver.clone(), context)?;
@@ -71,13 +72,15 @@ fn set_by_name(
             .into());
     }
 
-    // Cache the property.
+    // Cache the property, unless the set changed the object's shape (e.g. a setter that defines
+    // an own property): the slot was looked up in the previous shape.
     let slot = *context.slot();
-    if succeeded && slot.is_cacheable() {
+    if succeeded
+        && slot.is_cacheable()
+        && object.borrow().shape().to_addr_usize() == shape.to_addr_usize()
+    {
         let ic = &context.vm.frame().code_block.ic[usize::from(index)];
-        let object_borrowed = object.borrow();
-        let shape = object_borrowed.shape();
-        ic.set(shape, slot);
+        ic.set(&shape, slot);
     }
 
     Ok(())