Bug 185476 – [JSC] Fix ArraySpeciesCreate to return a new Array when the given object is not an array

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Leo Balter]

[JSC] Fix ArraySpeciesCreate to return a new Array when the given object is not an array

[Leo Balter]

Created attachment 339969 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 339969 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=339969&action=review

> Source/JavaScriptCore/runtime/ArrayPrototype.cpp:256
> +        // If isArray is false, return ? ArrayCreate(length).
> +        JSGlobalObject* globalObject = thisObject->globalObject();
> +        JSValue newValue = constructArrayWithSizeQuirk(exec, nullptr, globalObject, jsNumber(length), exec->newTarget());
> +        JSObject* newObject = newValue.toObject(exec);
>          RETURN_IF_EXCEPTION(scope, exceptionResult());
> +        return std::make_pair(SpeciesConstructResult::CreatedObject, newObject);

Let's return `std::make_pair(SpeciesConstructResult::FastPath, nullptr)` since it creates an Array(length), it is fast path case.

[Leo Balter]

Created attachment 339974 [details]
Patch

[Leo Balter]

Created attachment 339977 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 339977 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 339977 [details]
Patch

Clearing flags on attachment: 339977

Committed r231572: <https://trac.webkit.org/changeset/231572>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/40096808>