[Webkit-unassigned] [Bug 186991] Different output compared with v8 and spidermonkey

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=186991

Gary Kwong [:gkw] [:nth10sd] <nth10sd at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nth10sd at gmail.com

--- Comment #1 from Gary Kwong [:gkw] [:nth10sd] <nth10sd at gmail.com> ---
I re-ran the testcase in comment #0 with git rev eb42a8967d53ebb95bd59b6d89662ac7fdf95a8b and it seems to show the intended output. It shows the wrong output with a build from mid-2017, or rev 011c994d52cc30bdec69aebed8ec1a025966b34a.

I then ran a bisection using robobisect, and it seems to point to the following commit as a possible fix to this bug:


commit e580b9a5fa9b5013b749e72f1c10946cb14af9aa
Author: caitp
Date:   Tue May 29 16:56:29 2018 +0000

    [JSC] Fix Array.prototype.concat fast case when single argument is Proxy
    https://bugs.webkit.org/show_bug.cgi?id=184267

    Reviewed by Saam Barati.

    </snip>

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232261 268f45cc-cd09-0410-ab3c-d52691b4dbfc


Is bug 184267 a likely fix?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200422/fbd3a0bd/attachment.htm>