[webkit-changes] [WebKit/WebKit] 9d30cd: Concat with a CSSStyleSheet and shadowRoot.adopted...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 9d30cd47aaab9cda55030b7eb9ecbe8aef869564
      https://github.com/WebKit/WebKit/commit/9d30cd47aaab9cda55030b7eb9ecbe8aef869564
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-03-13 (Mon, 13 Mar 2023)

  Changed paths:
    A JSTests/stress/array-concat-runtime-array.js
    A LayoutTests/cssom/array-concat-adoptedStyleSheets-expected.txt
    A LayoutTests/cssom/array-concat-adoptedStyleSheets.html
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp

  Log Message:
  -----------
  Concat with a CSSStyleSheet and shadowRoot.adoptedStyleSheets returns array in array
https://bugs.webkit.org/show_bug.cgi?id=253814
rdar://106667776

Reviewed by Alexey Shvayka, Mark Lam, Keith Miller and Chris Dumez.

We should bail out from the fast path of Array.prototype.concat when the parameter is Array but not JSArray.
This is the case when the parameter is ProxyObject or DerivedArray e.g. JSObservableArray.
This patch adds checks for both types in the fast path and returns null to go to the slow path.

* LayoutTests/cssom/array-concat-adoptedStyleSheets-expected.txt: Added.
* LayoutTests/cssom/array-concat-adoptedStyleSheets.html: Added.
* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::concatAppendOne):
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/261604@main