Deoptimize ObjectExpression when a __proto__ property is present (#4019)

* Deoptimize ObjectExpression when a __proto__ property is present

Closes #4014

* Integrate __proto__ detection with getPropertyMap

* Fix formatting

Co-authored-by: Lukas Taegert-Atkinson <lukastaegert@users.noreply.github.com>
Co-authored-by: Lukas Taegert-Atkinson <lukas.taegert-atkinson@tngtech.com>

src/ast/nodes/ObjectExpression.ts

@@ -307,27 +307,29 @@ export default class ObjectExpression extends NodeBase implements DeoptimizableE
 			}
 			const isWrite = property.kind !== 'get';
 			const isRead = property.kind !== 'set';
-			let key;
+			let key: string;
+			let unmatchable = false;
 			if (property.computed) {
 				const keyValue = property.key.getLiteralValueAtPath(
 					EMPTY_PATH,
 					SHARED_RECURSION_TRACKER,
 					this
 				);
-				if (keyValue === UnknownValue) {
-					if (isRead) {
-						this.unmatchablePropertiesRead.push(property);
-					} else {
-						this.unmatchablePropertiesWrite.push(property);
-					}
-					continue;
-				}
+				if (keyValue === UnknownValue) unmatchable = true;
 				key = String(keyValue);
 			} else if (property.key instanceof Identifier) {
 				key = property.key.name;
 			} else {
 				key = String((property.key as Literal).value);
 			}
+			if (unmatchable || (key === '__proto__' && !property.computed)) {
+				if (isRead) {
+					this.unmatchablePropertiesRead.push(property);
+				} else {
+					this.unmatchablePropertiesWrite.push(property);
+				}
+				continue;
+			}
 			const propertyMapProperty = propertyMap[key];
 			if (!propertyMapProperty) {
 				propertyMap[key] = {

test/form/samples/object-expression/proto-property/_config.js

@@ -0,0 +1,3 @@
+module.exports = {
+	description: 'Deoptimize when __proto__ is used'
+};

test/form/samples/object-expression/proto-property/_expected.js

@@ -0,0 +1,13 @@
+let proto = {
+  get a() { log(); }
+};
+
+let plainProto = {
+  __proto__: proto
+};
+if (plainProto.a) log("plainProto");
+
+let quotedProto = {
+  "__proto__": proto
+};
+if (quotedProto.a) log("quotedProto");

test/form/samples/object-expression/proto-property/main.js

@@ -0,0 +1,18 @@
+let basic = {
+  a: false
+};
+if (basic.a) log("basic");
+
+let proto = {
+  get a() { log(); }
+};
+
+let plainProto = {
+  __proto__: proto
+};
+if (plainProto.a) log("plainProto");
+
+let quotedProto = {
+  "__proto__": proto
+};
+if (quotedProto.a) log("quotedProto");