Diff
Modified: trunk/JSTests/ChangeLog (290212 => 290213)
--- trunk/JSTests/ChangeLog 2022-02-19 21:02:42 UTC (rev 290212)
+++ trunk/JSTests/ChangeLog 2022-02-19 21:16:01 UTC (rev 290213)
@@ -1,3 +1,20 @@
+2022-02-19 Commit Queue <commit-qu...@webkit.org>
+
+ Unreviewed, reverting r290194 and r290210.
+ https://bugs.webkit.org/show_bug.cgi?id=236890
+
+ debug crash
+
+ Reverted changesets:
+
+ "[JSC] Make ArrayPrototype just an array"
+ https://bugs.webkit.org/show_bug.cgi?id=236869
+ https://commits.webkit.org/r290194
+
+ "Unreviewed, use ArrayWithUndecided in ArrayPrototype"
+ https://bugs.webkit.org/show_bug.cgi?id=236869
+ https://commits.webkit.org/r290210
+
2022-02-19 Yusuke Suzuki <ysuz...@apple.com>
Unreviewed, use ArrayWithUndecided in ArrayPrototype
Deleted: trunk/JSTests/stress/array-prototype-concat.js (290212 => 290213)
--- trunk/JSTests/stress/array-prototype-concat.js 2022-02-19 21:02:42 UTC (rev 290212)
+++ trunk/JSTests/stress/array-prototype-concat.js 2022-02-19 21:16:01 UTC (rev 290213)
@@ -1 +0,0 @@
-Array.prototype.concat();
Modified: trunk/Source/_javascript_Core/ChangeLog (290212 => 290213)
--- trunk/Source/_javascript_Core/ChangeLog 2022-02-19 21:02:42 UTC (rev 290212)
+++ trunk/Source/_javascript_Core/ChangeLog 2022-02-19 21:16:01 UTC (rev 290213)
@@ -1,3 +1,20 @@
+2022-02-19 Commit Queue <commit-qu...@webkit.org>
+
+ Unreviewed, reverting r290194 and r290210.
+ https://bugs.webkit.org/show_bug.cgi?id=236890
+
+ debug crash
+
+ Reverted changesets:
+
+ "[JSC] Make ArrayPrototype just an array"
+ https://bugs.webkit.org/show_bug.cgi?id=236869
+ https://commits.webkit.org/r290194
+
+ "Unreviewed, use ArrayWithUndecided in ArrayPrototype"
+ https://bugs.webkit.org/show_bug.cgi?id=236869
+ https://commits.webkit.org/r290210
+
2022-02-19 Yusuke Suzuki <ysuz...@apple.com>
Unreviewed, use ArrayWithUndecided in ArrayPrototype
Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp (290212 => 290213)
--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2022-02-19 21:02:42 UTC (rev 290212)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2022-02-19 21:16:01 UTC (rev 290213)
@@ -57,6 +57,8 @@
// ------------------------------ ArrayPrototype ----------------------------
+const ClassInfo ArrayPrototype::s_info = {"Array", &JSArray::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(ArrayPrototype)};
+
ArrayPrototype* ArrayPrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
{
ArrayPrototype* prototype = new (NotNull, allocateCell<ArrayPrototype>(vm)) ArrayPrototype(vm, structure);
@@ -74,8 +76,6 @@
{
Base::finishCreation(vm);
ASSERT(inherits(vm, info()));
- ASSERT(info() == JSArray::info());
- ASSERT(type() == ArrayType);
putDirectWithoutTransition(vm, vm.propertyNames->toString, globalObject->arrayProtoToStringFunction(), static_cast<unsigned>(PropertyAttribute::DontEnum));
putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPublicName(), globalObject->arrayProtoValuesFunction(), static_cast<unsigned>(PropertyAttribute::DontEnum));
Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.h (290212 => 290213)
--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.h 2022-02-19 21:02:42 UTC (rev 290212)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.h 2022-02-19 21:16:01 UTC (rev 290213)
@@ -24,17 +24,23 @@
namespace JSC {
-// This is a simple JSArray, only including some special initialization sequence.
-// We must not have special ArrayPrototype::info.
class ArrayPrototype final : public JSArray {
public:
using Base = JSArray;
+ enum class SpeciesWatchpointStatus {
+ Uninitialized,
+ Initialized,
+ Fired
+ };
+
static ArrayPrototype* create(VM&, JSGlobalObject*, Structure*);
+
+ DECLARE_EXPORT_INFO;
static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
- return Base::createStructure(vm, globalObject, prototype, ArrayWithUndecided);
+ return Structure::create(vm, globalObject, prototype, TypeInfo(DerivedArrayType, StructureFlags), info(), ArrayClass);
}
private:
