Apply https://github.com/WebKit/WebKit/commit/31063ed7146c579bafe527591da98b33049dd159.patch

Author: Jarred-Sumner

JSTests/stress/dfg-get-global-object-should-use-object-edge.js

@@ -0,0 +1,12 @@
+//@ runDefault("--validateOptions=true", "--thresholdForJITSoon=10", "--thresholdForJITAfterWarmUp=10", "--thresholdForOptimizeAfterWarmUp=100", "--thresholdForOptimizeAfterLongWarmUp=100", "--thresholdForOptimizeSoon=100", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--thresholdForFTLOptimizeSoon=1000", "--validateBCE=true", "--useConcurrentJIT=0")
+
+function opt(arg) {
+    try {
+        arg.test({ test: "padEnd" });
+    } catch (e) { }
+    arg.test(/123/);
+}
+
+for (let i = 0; i < 50; i++) {
+    opt({ test: opt });
+}

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -2115,12 +2115,16 @@ class FixupPhase : public Phase {
         case SkipScope:
         case GetScope:
         case GetGetter:
-        case GetSetter:
-        case GetGlobalObject: {
+        case GetSetter: {
             fixEdge<KnownCellUse>(node->child1());
             break;
         }
 
+        case GetGlobalObject: {
+            fixEdge<ObjectUse>(node->child1());
+            break;
+        }
+
         case UnwrapGlobalProxy: {
             fixEdge<GlobalProxyUse>(node->child1());
             break;

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -7966,9 +7966,15 @@ void SpeculativeJIT::compileGetGlobalObject(Node* node)
 {
     SpeculateCellOperand object(this, node->child1());
     GPRTemporary result(this);
-    emitLoadStructure(vm(), object.gpr(), result.gpr());
-    loadPtr(Address(result.gpr(), Structure::globalObjectOffset()), result.gpr());
-    cellResult(result.gpr(), node);
+
+    GPRReg objectGPR = object.gpr();
+    GPRReg resultGPR = result.gpr();
+
+    speculateObject(node->child1(), objectGPR);
+
+    emitLoadStructure(vm(), objectGPR, resultGPR);
+    loadPtr(Address(resultGPR, Structure::globalObjectOffset()), resultGPR);
+    cellResult(resultGPR, node);
 }
 
 void SpeculativeJIT::compileGetGlobalThis(Node* node)

Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -11749,7 +11749,7 @@ IGNORE_CLANG_WARNINGS_END
 
     void compileGetGlobalObject()
     {
-        LValue structure = loadStructure(lowCell(m_node->child1()));
+        LValue structure = loadStructure(lowObject(m_node->child1()));
         setJSValue(m_out.loadPtr(structure, m_heaps.Structure_globalObject));
     }