[webkit-changes] [WebKit/WebKit] 0378ae: [JSC] Fix assertion in attemptToForceStringArrayMo...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0378ae300a225e089a0b2b0305fdf94091024fe5
      https://github.com/WebKit/WebKit/commit/0378ae300a225e089a0b2b0305fdf94091024fe5
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2023-05-25 (Thu, 25 May 2023)

  Changed paths:
    A JSTests/stress/force-string-array-or-string.js
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

  Log Message:
  -----------
  [JSC] Fix assertion in attemptToForceStringArrayModeByToStringConversion for DFG fix up phase
https://bugs.webkit.org/show_bug.cgi?id=257362
rdar://109642729

Reviewed by Yusuke Suzuki.

Since attemptToForceStringArrayModeByToStringConversion is only
used in attemptToMakeGetArrayLength we only need to assert Array::Generic
and Array::Read for the sanity check.

* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):

Canonical link: https://commits.webkit.org/264546@main