Modified: branches/safari-604-branch/JSTests/ChangeLog (223099 => 223100)
--- branches/safari-604-branch/JSTests/ChangeLog 2017-10-10 00:08:14 UTC (rev 223099)
+++ branches/safari-604-branch/JSTests/ChangeLog 2017-10-10 00:08:16 UTC (rev 223100)
@@ -1,5 +1,21 @@
2017-10-02 Jason Marcell <[email protected]>
+ Cherry-pick r222598. rdar://problem/34771434
+
+ 2017-09-27 Mark Lam <[email protected]>
+
+ JSArray::canFastCopy() should fail if the source and destination arrays are the same.
+ https://bugs.webkit.org/show_bug.cgi?id=177584
+ <rdar://problem/34463903>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-177584.js: Added.
+ (assertEqual):
+ (Array.prototype.Symbol.species):
+
+2017-10-02 Jason Marcell <[email protected]>
+
Cherry-pick r221400. rdar://problem/34771396
2017-08-30 Saam Barati <[email protected]>
Added: branches/safari-604-branch/JSTests/stress/regress-177584.js (0 => 223100)
--- branches/safari-604-branch/JSTests/stress/regress-177584.js (rev 0)
+++ branches/safari-604-branch/JSTests/stress/regress-177584.js 2017-10-10 00:08:16 UTC (rev 223100)
@@ -0,0 +1,18 @@
+function assertEqual(actual, expected) {
+ if (actual != expected)
+ throw "Failed: actual: " + actual + ", expected: " + expected;
+}
+
+var a0 = [,,,,,,,,,,,,,];
+
+Array.prototype.constructor = {
+ [Symbol.species]: function() {
+ return a0;
+ }
+}
+
+var a1 = [1,2,3,4];
+var a2 = a1.concat(a0);
+
+assertEqual(a0, a2);
+assertEqual(a0, "1,2,3,4,1,2,3,4,1,2,3,4,1,2,3,4,1");
Modified: branches/safari-604-branch/Source/_javascript_Core/ChangeLog (223099 => 223100)
--- branches/safari-604-branch/Source/_javascript_Core/ChangeLog 2017-10-10 00:08:14 UTC (rev 223099)
+++ branches/safari-604-branch/Source/_javascript_Core/ChangeLog 2017-10-10 00:08:16 UTC (rev 223100)
@@ -1,5 +1,23 @@
2017-10-02 Jason Marcell <[email protected]>
+ Cherry-pick r222598. rdar://problem/34771434
+
+ 2017-09-27 Mark Lam <[email protected]>
+
+ JSArray::canFastCopy() should fail if the source and destination arrays are the same.
+ https://bugs.webkit.org/show_bug.cgi?id=177584
+ <rdar://problem/34463903>
+
+ Reviewed by Saam Barati.
+
+ If the source and destination arrays are the same, we may be copying overlapping
+ regions. Hence, we need to take the slow path.
+
+ * runtime/JSArrayInlines.h:
+ (JSC::JSArray::canFastCopy):
+
+2017-10-02 Jason Marcell <[email protected]>
+
Cherry-pick r221400. rdar://problem/34771396
2017-08-30 Saam Barati <[email protected]>
Modified: branches/safari-604-branch/Source/_javascript_Core/runtime/JSArrayInlines.h (223099 => 223100)
--- branches/safari-604-branch/Source/_javascript_Core/runtime/JSArrayInlines.h 2017-10-10 00:08:14 UTC (rev 223099)
+++ branches/safari-604-branch/Source/_javascript_Core/runtime/JSArrayInlines.h 2017-10-10 00:08:16 UTC (rev 223100)
@@ -57,6 +57,8 @@
inline bool JSArray::canFastCopy(VM& vm, JSArray* otherArray)
{
+ if (otherArray == this)
+ return false;
if (hasAnyArrayStorage(indexingType()) || hasAnyArrayStorage(otherArray->indexingType()))
return false;
// FIXME: We should have a watchpoint for indexed properties on Array.prototype and Object.prototype
