Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0c5f00d27cc29dd971cbd7c963dd36c0906693c1
https://github.com/WebKit/WebKit/commit/0c5f00d27cc29dd971cbd7c963dd36c0906693c1
Author: Yusuke Suzuki <[email protected]>
Date: 2023-12-08 (Fri, 08 Dec 2023)
Changed paths:
A JSTests/stress/array-from-prototype.js
M Source/JavaScriptCore/runtime/ArrayPrototype.cpp
Log Message:
-----------
[JSC] Array.from fast path should only handle pure JSArray
https://bugs.webkit.org/show_bug.cgi?id=266053
rdar://119341126
Reviewed by Mark Lam.
DerivedArray can have IndexingType == NoIndexingShape JSArray. This patch
limits Array.from fast path only for pure JSArray (by using isJSArray check).
Also, as an extra guard (and make it explicit for readability), we also add a
code using slow path when IndexingType is ArrayClass (this means
NoIndexingShape).
* JSTests/stress/array-from-prototype.js: Added.
* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/271720@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
