[webkit-changes] [WebKit/WebKit] ba9245: [JSC] Fix the fast path of copying indexed propert...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ba9245ab655b2d0604e96bb386d990175a407865
      https://github.com/WebKit/WebKit/commit/ba9245ab655b2d0604e96bb386d990175a407865
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2023-10-28 (Sat, 28 Oct 2023)

  Changed paths:
    A JSTests/stress/object-assign-values-order.js
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSObjectInlines.h
    M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
    M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h

  Log Message:
  -----------
  [JSC] Fix the fast path of copying indexed properties for objectConstructorValues
https://bugs.webkit.org/show_bug.cgi?id=263742
rdar://117439508

Reviewed by Yusuke Suzuki.

The fast path of copying indexed properties for objectConstructorValues
should copy property and value pairs in ascending order by the indexed
property. See specs:

- https://tc39.es/ecma262/#sec-object.values
- https://tc39.es/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots-ownpropertykeys
- https://tc39.es/ecma262/#sec-string-exotic-objects-ownpropertykeys
- https://tc39.es/ecma262/#sec-integer-indexed-exotic-objects-ownpropertykeys
- https://tc39.es/ecma262/#sec-module-namespace-exotic-objects-ownpropertykeys
- https://tc39.es/ecma262/#sec-ordinaryownpropertykeys

* JSTests/stress/object-assign-values-order.js: Added.
(shouldBe):
* Source/JavaScriptCore/runtime/JSObject.h:
* Source/JavaScriptCore/runtime/JSObjectInlines.h:
(JSC::JSObject::forEachOwnIndexedProperty):
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::objectAssignIndexedPropertiesFast):

Canonical link: https://commits.webkit.org/269896@main