[JSC] Fix Array.prototype.concat fast case when single argument is Proxy
authorcaitp@igalia.com <caitp@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 29 May 2018 16:56:29 +0000 (16:56 +0000)
committercaitp@igalia.com <caitp@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 29 May 2018 16:56:29 +0000 (16:56 +0000)
commite580b9a5fa9b5013b749e72f1c10946cb14af9aa
treea533dfcac2b5f96cd484055499908394dc9b73d6
parent05da96a18472f7e88d644a569bb1624eaa2b6ece
[JSC] Fix Array.prototype.concat fast case when single argument is Proxy
https://bugs.webkit.org/show_bug.cgi?id=184267

Reviewed by Saam Barati.

JSTests:

* stress/array-concat-fast-spread-proxy.js: Copied from JSTests/stress/array-concat-spread-proxy.js.
(arrayEq):
(catch):
* stress/array-concat-spread-proxy.js:

Source/JavaScriptCore:

Before this patch, the fast case for Array.prototype.concat was taken if
there was a single argument passed to the function, which is either a
non-JSCell, or an ObjectType JSCell not marked as concat-spreadable.
This incorrectly prevented Proxy objects from being spread when
they were the only argument passed to A.prototype.concat(), violating ECMA-262.

* builtins/ArrayPrototype.js:
(concat):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232261 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/array-concat-fast-spread-proxy.js [new file with mode: 0644]
JSTests/stress/array-concat-spread-proxy.js
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/builtins/ArrayPrototype.js