[webkit-changes] [WebKit/WebKit] 448746: [JSC] `Array.prototype.toReversed` should fill hol...

[SUZUKI Sosuke]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 448746e32905bec49553cfca2e174d9381143386
      https://github.com/WebKit/WebKit/commit/448746e32905bec49553cfca2e174d9381143386
  Author: Sosuke Suzuki <aosukeke at gmail.com>
  Date:   2024-12-30 (Mon, 30 Dec 2024)

  Changed paths:
    A JSTests/stress/array-prototype-toReversed-empty.js
    M Source/JavaScriptCore/runtime/JSArray.cpp

  Log Message:
  -----------
  [JSC] `Array.prototype.toReversed` should fill holes with undefined
https://bugs.webkit.org/show_bug.cgi?id=285254

Reviewed by Yusuke Suzuki.

https://commits.webkit.org/287431@main rewrote `Array.prototype.toReversed`
in C++. According to the spec[1], `toReversed` should fill holes with `undefined`,
but this C++ implementation sometimes leaves those holes intact.

This commit fixes that issue by making the function bail out from the fast path
when the array contains any holes.

[1]: https://tc39.es/ecma262/#sec-array.prototype.toreversed

* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::JSArray::fastToReversed):

Canonical link: https://commits.webkit.org/288339@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications