Ensure newShape.isValid() is checked just before execution the specialization

Author: eregon

src/main/java/org/truffleruby/language/objects/WriteObjectFieldNode.java

@@ -114,7 +114,7 @@ public void writeNewField(DynamicObject object, Object value, boolean generalize
             @Cached("object.getShape()") Shape oldShape,
             @Cached("defineProperty(oldShape, value, generalize)") Shape newShape,
             @Cached("getNewLocation(newShape)") Location newLocation,
-            @Cached("createAssumption(oldShape, newLocation)") Assumption validLocation,
+            @Cached("createAssumption(oldShape, newShape, newLocation)") Assumption validLocation,
             @Cached("isShared(oldShape)") boolean shared,
             @Cached("createWriteBarrierNode(shared)") WriteBarrierNode writeBarrierNode,
             @Cached("createProfile(shared)") BranchProfile shapeRaceProfile) {
@@ -205,6 +205,15 @@ protected Assumption createAssumption(Shape shape, Location location) {
         return Truffle.getRuntime().createAssumption("object location is valid");
     }
 
+    // The location is passed here even though it's not used,
+    // to make sure the DSL checks this Assumption after all lookups are done in executeAndSpecialize().
+    protected Assumption createAssumption(Shape oldShape, Shape newShape, Location location) {
+        if (!oldShape.isValid() || !newShape.isValid()) {
+            return NeverValidAssumption.INSTANCE;
+        }
+        return Truffle.getRuntime().createAssumption("object location is valid");
+    }
+
     protected int getCacheLimit() {
         return getContext().getOptions().INSTANCE_VARIABLE_CACHE;
     }