[turbofan] Fix bug in reduction of StoreDataPropertyInLiteral

JSNativeContextSpecialization lowered this operator to a regular
property store, potentially ignoring a request to set the "name"
property of a function.

This CL performs the lowering only if there's no such request.

Bug: chromium:1068494
Change-Id: Ia2eaf05af9c8402f9e6450ee519a7c36c18cd44e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139581
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67058}

src/compiler/js-native-context-specialization.cc

@@ -2455,8 +2455,16 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
   FeedbackParameter const& p = FeedbackParameterOf(node->op());
   Node* const key = NodeProperties::GetValueInput(node, 1);
   Node* const value = NodeProperties::GetValueInput(node, 2);
+  Node* const flags = NodeProperties::GetValueInput(node, 3);
 
   if (!p.feedback().IsValid()) return NoChange();
+
+  NumberMatcher mflags(flags);
+  CHECK(mflags.HasValue());
+  DataPropertyInLiteralFlags cflags(mflags.Value());
+  DCHECK(!(cflags & DataPropertyInLiteralFlag::kDontEnum));
+  if (cflags & DataPropertyInLiteralFlag::kSetFunctionName) return NoChange();
+
   return ReducePropertyAccess(node, key, base::nullopt, value,
                               FeedbackSource(p.feedback()),
                               AccessMode::kStoreInLiteral);

src/runtime/runtime-object.cc

@@ -916,9 +916,7 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
     }
   }
 
-  DataPropertyInLiteralFlags flags =
-      static_cast<DataPropertyInLiteralFlag>(flag);
-
+  DataPropertyInLiteralFlags flags(flag);
   PropertyAttributes attrs = (flags & DataPropertyInLiteralFlag::kDontEnum)
                                  ? PropertyAttributes::DONT_ENUM
                                  : PropertyAttributes::NONE;

test/mjsunit/compiler/regress-1068494.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return { ['bar']: class {} };
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals('bar', foo().bar.name);
+assertEquals('bar', foo().bar.name);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals('bar', foo().bar.name);