JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 18 Apr 2017 05:55:41 +0000 (05:55 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 18 Apr 2017 05:55:41 +0000 (05:55 +0000)
commitbf8185054d8514c159e9393ac72560c1c98d1b0c
tree4eb0a882f7f62e0bd3bbaec36525a3c85762ff40
parent9da6338975f31cd81027e21174b07310413abd0c
JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
https://bugs.webkit.org/show_bug.cgi?id=170896
<rdar://problem/31651319>

Reviewed by JF Bastien and Keith Miller.

JSTests:

* stress/regress-170896.js: Added.

Source/JavaScriptCore:

* runtime/JSArray.cpp:
(JSC::JSArray::appendMemcpy):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@215451 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/regress-170896.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSArray.cpp