[webkit-changes] [WebKit/WebKit] c68cf4: [JSC] Array.from fast path should handle array wit...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: c68cf48dd75cff6ed634b66127a0bbf13ef913bb
      https://github.com/WebKit/WebKit/commit/c68cf48dd75cff6ed634b66127a0bbf13ef913bb
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-11-14 (Tue, 14 Nov 2023)

  Changed paths:
    A JSTests/stress/array-from-empty.js
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp

  Log Message:
  -----------
  [JSC] Array.from fast path should handle array with holes
https://bugs.webkit.org/show_bug.cgi?id=264853
rdar://118417483

Reviewed by Michael Saboff.

Array.from fills the result with undefined when it detects a hole.
So the fast path needs to handle this properly: we should fill undefined when
we found a hole in the source array. This patch fixes the fast path implementation
correctly filling undefined for source's holes. Since they are undefined,

1. When ArrayWithUndecided has some length, it should create ArrayWithContiguous with undefineds.
2. When ArrayWithInt32 has some holes, it should create ArrayWithContiguous with undefineds.
3. When ArrayWithDouble has some holes, it should create ArrayWithContiguous with undefineds.
4. When ArrayWithArrayStorage has some holes, it should fill undefined for holes.
5. Otherwise, we can just copy the underlying content.

* JSTests/stress/array-from-empty.js: Added.
(shouldBe):
(throw.new.Error):
(else.shouldBe):
* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::moveElements):
(JSC::concatAppendOne):
(JSC::copyElements):
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/270748@main