[JSC] NativeExecutable should have name and length in the same way to FunctionExecutable

https://bugs.webkit.org/show_bug.cgi?id=316443
rdar://178844469

Reviewed by Justin Michaud and Yijia Huang.

This is slight optimization for case doing `bind` with native functions,
but largely a preparation for introducing optimization for patterns converting
JS builtins to C++ native functions. Previously NativeExecutable was not
holding length / name appropriately while FunctionExecutable was doing
so. As a result, JSBoundFunction related optimization was skipping
NativeExecutable cases. This becomes a problem when we convert JS
builtin functions to Native version as bind starts going to the slow path.
This patch alignes NativeExecutable's name and length handling much more
to FunctionExecutable.

* JSTests/stress/promise-resolving-functions-name-and-length.js: Added.
(shouldBe):
(new.Promise):
(checkAnonymousBuiltin):
(i.new.Promise):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/jit/JITThunks.cpp:
(JSC::JITThunks::WeakNativeExecutableHash::hash):
(JSC::JITThunks::WeakNativeExecutableHash::equal):
(JSC::JITThunks::finalize):
(JSC::JITThunks::hostFunctionStub):
* Source/JavaScriptCore/jit/JITThunks.h:
* Source/JavaScriptCore/runtime/BooleanConstructor.cpp:
(JSC::BooleanConstructor::finishCreation):
(JSC::BooleanConstructor::create):
* Source/JavaScriptCore/runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::canSkipNameAndLengthMaterialization):
* Source/JavaScriptCore/runtime/JSCustomGetterFunction.cpp:
(JSC::JSCustomGetterFunction::create):
* Source/JavaScriptCore/runtime/JSCustomSetterFunction.cpp:
(JSC::JSCustomSetterFunction::create):
* Source/JavaScriptCore/runtime/JSFunction.cpp:
(JSC::JSFunction::create):
(JSC::JSFunction::reifyLazyPropertyIfNeeded):
(JSC::JSFunction::reifyLazyPropertyForHostOrBuiltinIfNeeded):
(JSC::JSFunction::reifyLazyBoundNameIfNeeded):
(JSC::JSFunction::finishCreation): Deleted.
* Source/JavaScriptCore/runtime/JSFunction.h:
* Source/JavaScriptCore/runtime/JSFunctionInlines.h:
(JSC::JSFunction::originalLength):
(JSC::JSFunction::originalName):
(JSC::JSFunction::canAssumeNameAndLengthAreOriginal):
* Source/JavaScriptCore/runtime/JSFunctionWithFields.cpp:
(JSC::JSFunctionWithFields::create):
* Source/JavaScriptCore/runtime/JSFunctionWithFields.h:
* Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp:
(JSC::JSNativeStdFunction::getHostFunction):
(JSC::JSNativeStdFunction::create):
(JSC::JSNativeStdFunction::finishCreation): Deleted.
* Source/JavaScriptCore/runtime/JSNativeStdFunction.h:
* Source/JavaScriptCore/runtime/JSPromise.cpp:
(JSC::JSPromise::createFirstResolveFunction):
(JSC::JSPromise::createFirstRejectFunction):
* Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp:
(JSC::promiseAllSlow):
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::promiseAllSettledSlow):
(JSC::promiseAnySlow):
* Source/JavaScriptCore/runtime/JSPromisePrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::promiseProtoFuncFinallySlow):
* Source/JavaScriptCore/runtime/NativeExecutable.cpp:
(JSC::NativeExecutable::create):
(JSC::NativeExecutable::finishCreation):
(JSC::NativeExecutable::nameJSString const):
* Source/JavaScriptCore/runtime/NativeExecutable.h:
* Source/JavaScriptCore/runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::create):
(JSC::NumberConstructor::finishCreation):
* Source/JavaScriptCore/runtime/PinballCompletion.cpp:
(JSC::createHandler):
* Source/JavaScriptCore/runtime/StringConstructor.cpp:
(JSC::StringConstructor::finishCreation):
(JSC::StringConstructor::create):
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::getHostFunction):
(JSC::VM::getBoundFunction):
(JSC::VM::getRemoteFunction):
(JSC::VM::promiseResolvingFunctionResolveExecutableSlow):
(JSC::VM::promiseResolvingFunctionRejectExecutableSlow):
(JSC::VM::promiseFirstResolvingFunctionResolveExecutableSlow):
(JSC::VM::promiseFirstResolvingFunctionRejectExecutableSlow):
(JSC::VM::promiseResolvingFunctionResolveWithInternalMicrotaskExecutableSlow):
(JSC::VM::promiseResolvingFunctionRejectWithInternalMicrotaskExecutableSlow):
(JSC::VM::promiseCapabilityExecutorExecutableSlow):
(JSC::VM::promiseAllFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSlowFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledRejectFunctionExecutableSlow):
(JSC::VM::promiseAllSettledSlowFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledSlowRejectFunctionExecutableSlow):
(JSC::VM::promiseAnyRejectFunctionExecutableSlow):
(JSC::VM::promiseAnySlowRejectFunctionExecutableSlow):
* Source/JavaScriptCore/runtime/VM.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp:
(JSC::WebAssemblyFunction::create):
* Source/JavaScriptCore/wasm/js/WebAssemblyFunctionBase.cpp:
(JSC::WebAssemblyFunctionBase::finishCreation): Deleted.
* Source/JavaScriptCore/wasm/js/WebAssemblyFunctionBase.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyPromising.cpp:
(JSC::createWebAssemblyPromisingFunction):
* Source/JavaScriptCore/wasm/js/WebAssemblySuspending.cpp:
(JSC::createWebAssemblySuspendingFunction):
* Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.cpp:
(JSC::WebAssemblyWrapperFunction::create):

Canonical link: https://commits.webkit.org/314682@main

Author: Constellation

JSTests/stress/promise-resolving-functions-name-and-length.js

@@ -0,0 +1,96 @@
+// Regression test for https://bugs.webkit.org/show_bug.cgi?id=316443
+// NativeExecutable now holds name/length the same way FunctionExecutable does, and the
+// internal promise resolving / combinator / finally functions reify their "name" and "length"
+// from the NativeExecutable instead of receiving them eagerly at creation time. These functions
+// are spec-anonymous built-ins (CreateBuiltinFunction with name ""), so they must expose an
+// *own* "name" property whose value is "" (not undefined, not inherited from Function.prototype),
+// and an *own* "length" property. This locks that observable shape down.
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`FAIL: expected '${expected}' actual '${actual}'`);
+}
+
+function checkAnonymousBuiltin(label, f, expectedLength) {
+    shouldBe(typeof f, "function");
+
+    // "name" must be an own property (not merely inherited from Function.prototype.name === "").
+    shouldBe(Object.prototype.hasOwnProperty.call(f, "name"), true);
+    shouldBe(f.name, "");
+
+    let nameDesc = Object.getOwnPropertyDescriptor(f, "name");
+    shouldBe(nameDesc.value, "");
+    shouldBe(nameDesc.writable, false);
+    shouldBe(nameDesc.enumerable, false);
+    shouldBe(nameDesc.configurable, true);
+
+    // "length" must be an own property with the expected value.
+    shouldBe(Object.prototype.hasOwnProperty.call(f, "length"), true);
+    shouldBe(f.length, expectedLength);
+
+    let lengthDesc = Object.getOwnPropertyDescriptor(f, "length");
+    shouldBe(lengthDesc.value, expectedLength);
+    shouldBe(lengthDesc.writable, false);
+    shouldBe(lengthDesc.enumerable, false);
+    shouldBe(lengthDesc.configurable, true);
+
+    if (label) { /* keep label referenced for debugging */ }
+}
+
+// Resolve / reject functions handed to a Promise executor (CreateResolvingFunctions).
+{
+    let resolve, reject;
+    new Promise(function (res, rej) {
+        resolve = res;
+        reject = rej;
+    });
+    checkAnonymousBuiltin("resolve", resolve, 1);
+    checkAnonymousBuiltin("reject", reject, 1);
+}
+
+// Promise.withResolvers exposes the same pair of functions.
+{
+    let { resolve, reject } = Promise.withResolvers();
+    checkAnonymousBuiltin("withResolvers.resolve", resolve, 1);
+    checkAnonymousBuiltin("withResolvers.reject", reject, 1);
+}
+
+// Reading "name" first, then "length" (and vice versa) must both reify correctly and independently.
+{
+    let resolve, reject;
+    new Promise(function (res, rej) { resolve = res; reject = rej; });
+    // Force name reification before touching length.
+    shouldBe(resolve.name, "");
+    shouldBe(Object.prototype.hasOwnProperty.call(resolve, "length"), true);
+    shouldBe(resolve.length, 1);
+
+    // Force length reification before touching name on the other function.
+    shouldBe(reject.length, 1);
+    shouldBe(Object.prototype.hasOwnProperty.call(reject, "name"), true);
+    shouldBe(reject.name, "");
+}
+
+// The "name" property is configurable, so user code may redefine it; doing so must not
+// corrupt the originally-observed value on a freshly created pair.
+{
+    let resolve;
+    new Promise(function (res) { resolve = res; });
+    Object.defineProperty(resolve, "name", { value: "mutated", configurable: true });
+    shouldBe(resolve.name, "mutated");
+
+    let resolve2;
+    new Promise(function (res) { resolve2 = res; });
+    checkAnonymousBuiltin("resolve2", resolve2, 1);
+}
+
+// Run many times so the test covers all JIT tiers / repeated allocation paths.
+for (let i = 0; i < testLoopCount; ++i) {
+    let resolve, reject;
+    new Promise(function (res, rej) { resolve = res; reject = rej; });
+    shouldBe(resolve.name, "");
+    shouldBe(reject.name, "");
+    shouldBe(resolve.length, 1);
+    shouldBe(reject.length, 1);
+    shouldBe(Object.prototype.hasOwnProperty.call(resolve, "name"), true);
+    shouldBe(Object.prototype.hasOwnProperty.call(reject, "name"), true);
+}

Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -1235,9 +1235,13 @@ class ConstantFoldingPhase : public Phase {
                 Edge target = m_graph.child(node, 0);
                 AbstractValue& targetValue = m_state.forNode(target);
                 auto& structureSet = targetValue.m_structure;
-                if (!(targetValue.m_type & ~SpecFunction) && structureSet.isFinite() && structureSet.size() == 1) {
-                    RegisteredStructure structure = structureSet.onlyStructure();
-                    if (JSBoundFunction::canSkipNameAndLengthMaterialization(globalObject, structure.get())) {
+                if (!(targetValue.m_type & ~SpecFunction) && structureSet.isFinite() && structureSet.size() >= 1) {
+                    bool allCanSkip = true;
+                    structureSet.forEach([&](RegisteredStructure structure) {
+                        if (!JSBoundFunction::canSkipNameAndLengthMaterialization(globalObject, structure.get()))
+                            allCanSkip = false;
+                    });
+                    if (allCanSkip) {
                         node->convertToNewBoundFunction(m_graph.freeze(m_graph.m_vm.getBoundFunction(/* isJSFunction */ true, SourceTaintedOrigin::Untainted)));
                         changed = true;
                         break;

Source/JavaScriptCore/jit/JITThunks.cpp

@@ -74,7 +74,7 @@ static inline NativeExecutable& NODELETE getMayBeDyingNativeExecutable(const Wea
 
 inline unsigned JITThunks::WeakNativeExecutableHash::hash(const NativeExecutable* executable)
 {
-    return hash(executable->function(), executable->constructor(), executable->implementationVisibility(), executable->name());
+    return hash(executable->function(), executable->constructor(), executable->implementationVisibility(), executable->length(), executable->name());
 }
 
 inline unsigned JITThunks::WeakNativeExecutableHash::hash(const Weak<NativeExecutable>& key)
@@ -86,7 +86,7 @@ inline bool JITThunks::WeakNativeExecutableHash::equal(const NativeExecutable& a
 {
     if (&a == &b)
         return true;
-    return a.function() == b.function() && a.constructor() == b.constructor() && a.implementationVisibility() == b.implementationVisibility() && a.name() == b.name();
+    return a.function() == b.function() && a.constructor() == b.constructor() && a.implementationVisibility() == b.implementationVisibility() && a.length() == b.length() && a.name() == b.name();
 }
 
 inline bool JITThunks::WeakNativeExecutableHash::equal(const Weak<NativeExecutable>& a, const Weak<NativeExecutable>& b)
@@ -102,7 +102,7 @@ inline bool JITThunks::WeakNativeExecutableHash::equal(const Weak<NativeExecutab
 inline bool JITThunks::WeakNativeExecutableHash::equal(const Weak<NativeExecutable>& a, const HostFunctionKey& b)
 {
     auto& aExecutable = getMayBeDyingNativeExecutable(a);
-    return aExecutable.function() == std::get<0>(b) && aExecutable.constructor() == std::get<1>(b) && aExecutable.implementationVisibility() == std::get<2>(b) && aExecutable.name() == std::get<3>(b);
+    return aExecutable.function() == std::get<0>(b) && aExecutable.constructor() == std::get<1>(b) && aExecutable.implementationVisibility() == std::get<2>(b) && aExecutable.length() == std::get<3>(b) && aExecutable.name() == std::get<4>(b);
 }
 
 CodePtr<JITThunkPtrTag> JITThunks::ctiNativeCall(VM&)
@@ -227,7 +227,7 @@ struct JITThunks::NativeExecutableTranslator {
 void JITThunks::finalize(Handle<Unknown> handle, void*)
 {
     auto* nativeExecutable = static_cast<NativeExecutable*>(handle.get().asCell());
-    auto hostFunctionKey = std::make_tuple(nativeExecutable->function(), nativeExecutable->constructor(), nativeExecutable->implementationVisibility(), nativeExecutable->name());
+    auto hostFunctionKey = std::make_tuple(nativeExecutable->function(), nativeExecutable->constructor(), nativeExecutable->implementationVisibility(), nativeExecutable->length(), nativeExecutable->name());
     {
         AssertNoGC assertNoGC;
         auto iterator = m_nativeExecutableSet.find<HostKeySearcher>(hostFunctionKey);
@@ -238,17 +238,17 @@ void JITThunks::finalize(Handle<Unknown> handle, void*)
     }
 }
 
-NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction function, TaggedNativeFunction constructor, ImplementationVisibility implementationVisibility, const String& name)
+NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction function, TaggedNativeFunction constructor, ImplementationVisibility implementationVisibility, unsigned length, const String& name)
 {
-    return hostFunctionStub(vm, function, constructor, nullptr, implementationVisibility, NoIntrinsic, nullptr, name);
+    return hostFunctionStub(vm, function, constructor, nullptr, implementationVisibility, NoIntrinsic, nullptr, length, name);
 }
 
-NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction function, TaggedNativeFunction constructor, ThunkGenerator generator, ImplementationVisibility implementationVisibility, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String& name)
+NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction function, TaggedNativeFunction constructor, ThunkGenerator generator, ImplementationVisibility implementationVisibility, Intrinsic intrinsic, const DOMJIT::Signature* signature, unsigned length, const String& name)
 {
-    ASSERT(!isCompilationThread());    
+    ASSERT(!isCompilationThread());
     ASSERT(Options::useJIT());
 
-    auto hostFunctionKey = std::make_tuple(function, constructor, implementationVisibility, name);
+    auto hostFunctionKey = std::make_tuple(function, constructor, implementationVisibility, length, name);
     {
         AssertNoGC assertNoGC;
         auto iterator = m_nativeExecutableSet.find<HostKeySearcher>(hostFunctionKey);
@@ -268,10 +268,10 @@ NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction funct
         forCall = adoptRef(new NativeDOMJITCode(MacroAssemblerCodeRef<JSEntryPtrTag>::createSelfManagedCodeRef(ctiNativeCall(vm).retagged<JSEntryPtrTag>()), JITType::HostCallThunk, intrinsic, signature));
     else
         forCall = adoptRef(new NativeJITCode(MacroAssemblerCodeRef<JSEntryPtrTag>::createSelfManagedCodeRef(ctiNativeCall(vm).retagged<JSEntryPtrTag>()), JITType::HostCallThunk, intrinsic));
-    
+
     Ref<JSC::JITCode> forConstruct = adoptRef(*new NativeJITCode(MacroAssemblerCodeRef<JSEntryPtrTag>::createSelfManagedCodeRef(ctiNativeConstruct(vm).retagged<JSEntryPtrTag>()), JITType::HostCallThunk, NoIntrinsic));
-    
-    NativeExecutable* nativeExecutable = NativeExecutable::create(vm, forCall.releaseNonNull(), function, WTF::move(forConstruct), constructor, implementationVisibility, name);
+
+    NativeExecutable* nativeExecutable = NativeExecutable::create(vm, forCall.releaseNonNull(), function, WTF::move(forConstruct), constructor, implementationVisibility, length, name);
     {
         AssertNoGC assertNoGC;
         auto addResult = m_nativeExecutableSet.add<NativeExecutableTranslator>(nativeExecutable);
@@ -291,9 +291,9 @@ NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction funct
     return nativeExecutable;
 }
 
-NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction function, ThunkGenerator generator, ImplementationVisibility implementationVisibility, Intrinsic intrinsic, const String& name)
+NativeExecutable* JITThunks::hostFunctionStub(VM& vm, TaggedNativeFunction function, ThunkGenerator generator, ImplementationVisibility implementationVisibility, Intrinsic intrinsic, unsigned length, const String& name)
 {
-    return hostFunctionStub(vm, function, callHostFunctionAsConstructor, generator, implementationVisibility, intrinsic, nullptr, name);
+    return hostFunctionStub(vm, function, callHostFunctionAsConstructor, generator, implementationVisibility, intrinsic, nullptr, length, name);
 }
 
 } // namespace JSC

Source/JavaScriptCore/jit/JITThunks.h

@@ -203,9 +203,9 @@ class JITThunks final : private WeakHandleOwner {
     MacroAssemblerCodeRef<JITThunkPtrTag> ctiStub(VM&, ThunkGenerator);
     MacroAssemblerCodeRef<JITThunkPtrTag> ctiSlowPathFunctionStub(VM&, SlowPathFunction);
 
-    NativeExecutable* hostFunctionStub(VM&, TaggedNativeFunction, TaggedNativeFunction constructor, ImplementationVisibility, const String& name);
-    NativeExecutable* hostFunctionStub(VM&, TaggedNativeFunction, TaggedNativeFunction constructor, ThunkGenerator, ImplementationVisibility, Intrinsic, const DOMJIT::Signature*, const String& name);
-    NativeExecutable* hostFunctionStub(VM&, TaggedNativeFunction, ThunkGenerator, ImplementationVisibility, Intrinsic, const String& name);
+    NativeExecutable* hostFunctionStub(VM&, TaggedNativeFunction, TaggedNativeFunction constructor, ImplementationVisibility, unsigned length, const String& name);
+    NativeExecutable* hostFunctionStub(VM&, TaggedNativeFunction, TaggedNativeFunction constructor, ThunkGenerator, ImplementationVisibility, Intrinsic, const DOMJIT::Signature*, unsigned length, const String& name);
+    NativeExecutable* hostFunctionStub(VM&, TaggedNativeFunction, ThunkGenerator, ImplementationVisibility, Intrinsic, unsigned length, const String& name);
 
     void initialize(VM&);
 
@@ -221,14 +221,14 @@ class JITThunks final : private WeakHandleOwner {
     };
     using CTIStubMap = UncheckedKeyHashMap<ThunkGenerator, Entry>;
 
-    using HostFunctionKey = std::tuple<TaggedNativeFunction, TaggedNativeFunction, ImplementationVisibility, String>;
+    using HostFunctionKey = std::tuple<TaggedNativeFunction, TaggedNativeFunction, ImplementationVisibility, unsigned, String>;
 
     struct WeakNativeExecutableHash {
         static inline unsigned NODELETE hash(const Weak<NativeExecutable>&);
         static inline unsigned hash(const NativeExecutable*);
         static unsigned hash(const HostFunctionKey& key)
         {
-            return hash(std::get<0>(key), std::get<1>(key), std::get<2>(key), std::get<3>(key));
+            return hash(std::get<0>(key), std::get<1>(key), std::get<2>(key), std::get<3>(key), std::get<4>(key));
         }
 
         static inline bool NODELETE equal(const Weak<NativeExecutable>&, const Weak<NativeExecutable>&);
@@ -238,12 +238,13 @@ class JITThunks final : private WeakHandleOwner {
         static constexpr bool safeToCompareToEmptyOrDeleted = false;
 
     private:
-        static unsigned hash(TaggedNativeFunction function, TaggedNativeFunction constructor, ImplementationVisibility implementationVisibility, const String& name)
+        static unsigned hash(TaggedNativeFunction function, TaggedNativeFunction constructor, ImplementationVisibility implementationVisibility, unsigned length, const String& name)
         {
             Hasher hasher;
             WTF::add(hasher, function);
             WTF::add(hasher, constructor);
             WTF::add(hasher, implementationVisibility);
+            WTF::add(hasher, length);
             if (!name.isNull())
                 WTF::add(hasher, name);
             return hasher.hash();

Source/JavaScriptCore/runtime/BooleanConstructor.cpp

@@ -64,14 +64,12 @@ void BooleanConstructor::finishCreation(VM& vm, BooleanPrototype* booleanPrototy
 {
     Base::finishCreation(vm);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, booleanPrototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->name, jsString(vm, vm.propertyNames->Boolean.string()), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 BooleanConstructor* BooleanConstructor::create(VM& vm, Structure* structure, BooleanPrototype* booleanPrototype)
 {
     JSGlobalObject* globalObject = structure->realm();
-    NativeExecutable* executable = vm.getHostFunction(callBooleanConstructor, ImplementationVisibility::Public, BooleanConstructorIntrinsic, constructWithBooleanConstructor, nullptr, vm.propertyNames->Boolean.string());
+    NativeExecutable* executable = vm.getHostFunction(callBooleanConstructor, ImplementationVisibility::Public, BooleanConstructorIntrinsic, constructWithBooleanConstructor, nullptr, 1, vm.propertyNames->Boolean.string());
     BooleanConstructor* constructor = new (NotNull, allocateCell<BooleanConstructor>(vm)) BooleanConstructor(vm, executable, globalObject, structure);
     constructor->finishCreation(vm, booleanPrototype);
     return constructor;

Source/JavaScriptCore/runtime/JSBoundFunction.cpp

@@ -406,6 +406,11 @@ bool JSBoundFunction::canSkipNameAndLengthMaterialization(JSGlobalObject* global
         return true;
     if (structure == globalObject->sloppyFunctionStructure(true) || structure == globalObject->sloppyFunctionStructure(false))
         return true;
+    // Plain host functions now use the lazy reify path for length/name (mirroring JS function and
+    // builtin behavior), so an untransitioned hostFunctionStructure means length/name are still
+    // recoverable from NativeExecutable via originalLength()/originalName().
+    if (structure == globalObject->hostFunctionStructure())
+        return true;
 
     return false;
 }

Source/JavaScriptCore/runtime/JSCustomGetterFunction.cpp

@@ -63,13 +63,16 @@ JSCustomGetterFunction::JSCustomGetterFunction(VM& vm, NativeExecutable* executa
 JSCustomGetterFunction* JSCustomGetterFunction::create(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, CustomFunctionPointer getter, std::optional<DOMAttributeAnnotation> domAttribute)
 {
     ASSERT(getter);
-    NativeExecutable* executable = vm.getHostFunction(customGetterFunctionCall, ImplementationVisibility::Public, callHostFunctionAsConstructor, String(propertyName.publicName()));
+    NativeExecutable* executable = vm.getHostFunction(customGetterFunctionCall, ImplementationVisibility::Public, callHostFunctionAsConstructor, 0, String(propertyName.publicName()));
     Structure* structure = globalObject->customGetterFunctionStructure();
     JSCustomGetterFunction* function = new (NotNull, allocateCell<JSCustomGetterFunction>(vm)) JSCustomGetterFunction(vm, executable, globalObject, structure, propertyName, getter, domAttribute);
-
-    // Can't do this during initialization because getHostFunction might do a GC allocation.
+    function->finishCreation(vm);
+    // ECMAScript-style "get foo" name is exposed via the JSFunction's `name` property; keep the
+    // raw NativeExecutable name unprefixed so toString() renders as `function foo() { [native code] }`.
     auto name = makeString("get "_s, propertyName.publicName());
-    function->finishCreation(vm, executable, 0, name);
+    FunctionRareData* rareData = function->ensureRareData(vm);
+    rareData->setHasReifiedName();
+    function->putDirect(vm, vm.propertyNames->name, jsString(vm, WTF::move(name)), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     return function;
 }
 

Source/JavaScriptCore/runtime/JSCustomSetterFunction.cpp

@@ -53,13 +53,16 @@ JSCustomSetterFunction::JSCustomSetterFunction(VM& vm, NativeExecutable* executa
 JSCustomSetterFunction* JSCustomSetterFunction::create(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, CustomFunctionPointer setter)
 {
     ASSERT(setter);
-    NativeExecutable* executable = vm.getHostFunction(customSetterFunctionCall, ImplementationVisibility::Public, callHostFunctionAsConstructor, String(propertyName.publicName()));
+    NativeExecutable* executable = vm.getHostFunction(customSetterFunctionCall, ImplementationVisibility::Public, callHostFunctionAsConstructor, 1, String(propertyName.publicName()));
     Structure* structure = globalObject->customSetterFunctionStructure();
     JSCustomSetterFunction* function = new (NotNull, allocateCell<JSCustomSetterFunction>(vm)) JSCustomSetterFunction(vm, executable, globalObject, structure, propertyName, setter);
-
-    // Can't do this during initialization because getHostFunction might do a GC allocation.
+    function->finishCreation(vm);
+    // ECMAScript-style "set foo" name is exposed via the JSFunction's `name` property; keep the
+    // raw NativeExecutable name unprefixed so toString() renders as `function foo() { [native code] }`.
     auto name = makeString("set "_s, propertyName.publicName());
-    function->finishCreation(vm, executable, 1, name);
+    FunctionRareData* rareData = function->ensureRareData(vm);
+    rareData->setHasReifiedName();
+    function->putDirect(vm, vm.propertyNames->name, jsString(vm, WTF::move(name)), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     return function;
 }