[webkit-reviews] review denied: [Bug 185476] [JSC] Fix ArraySpeciesCreate to return a new Array when the given object is not an array : [Attachment 339969] Patch

[bugzilla-daemon at webkit.org]

Yusuke Suzuki <utatane.tea at gmail.com> has denied Leo Balter
<leonardo.balter at gmail.com>'s request for review:
Bug 185476: [JSC] Fix ArraySpeciesCreate to return a new Array when the given
object is not an array
https://bugs.webkit.org/show_bug.cgi?id=185476

Attachment 339969: Patch

https://bugs.webkit.org/attachment.cgi?id=339969&action=review




--- Comment #2 from Yusuke Suzuki <utatane.tea at gmail.com> ---
Comment on attachment 339969
  --> https://bugs.webkit.org/attachment.cgi?id=339969
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=339969&action=review

> Source/JavaScriptCore/runtime/ArrayPrototype.cpp:256
> +	   // If isArray is false, return ? ArrayCreate(length).
> +	   JSGlobalObject* globalObject = thisObject->globalObject();
> +	   JSValue newValue = constructArrayWithSizeQuirk(exec, nullptr,
globalObject, jsNumber(length), exec->newTarget());
> +	   JSObject* newObject = newValue.toObject(exec);
>	   RETURN_IF_EXCEPTION(scope, exceptionResult());
> +	   return std::make_pair(SpeciesConstructResult::CreatedObject,
newObject);

Let's return `std::make_pair(SpeciesConstructResult::FastPath, nullptr)` since
it creates an Array(length), it is fast path case.