[compiler] handle DefineOwnProperty for global object

Bug: chromium:1353360
Change-Id: Id39bfb72ba0ffc6e547b907bb82599fb4a0529a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3834255
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82556}

src/compiler/js-native-context-specialization.cc

@@ -976,8 +976,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
             jsgraph()->Constant(property_cell), effect, control);
       }
     }
-  } else {
-    DCHECK_EQ(AccessMode::kStore, access_mode);
+  } else if (access_mode == AccessMode::kStore) {
     DCHECK_EQ(receiver, lookup_start_object);
     DCHECK(!property_details.IsReadOnly());
     switch (property_details.cell_type()) {
@@ -1045,6 +1044,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       case PropertyCellType::kInTransition:
         UNREACHABLE();
     }
+  } else {
+    return NoChange();
   }
 
   ReplaceWithValue(node, value, effect, control);

test/mjsunit/compiler/regress-crbug-1353360.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class A {
+  constructor() {
+    return globalThis;
+  }
+}
+
+class B extends A {
+  field = 'abc';
+  constructor() {
+    super();
+  }
+}
+
+function f() {
+  return new B();
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+f();
+
+function g() {
+  class C extends A {
+    #privateField = 1;
+    constructor() {
+      super();
+    }
+  }
+  new C();
+}
+
+%PrepareFunctionForOptimization(g);
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
+g();