Bug 285254
| Summary: | [JSC] `Array.prototype.toReversed` should fill holes with undefined | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Sosuke Suzuki <sosuke> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Sosuke Suzuki
https://commits.webkit.org/287431@main rewrote `Array.prototype.toReversed`
in C++. According to the spec[1], `toReversed` should fill holes with `undefined`,
but this C++ implementation sometimes leaves those holes intact.
This commit fixes that issue by making the function bail out from the fast path
when the array contains any holes.
[1]: https://tc39.es/ecma262/#sec-array.prototype.toreversed
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Sosuke Suzuki
Pull request: https://github.com/WebKit/WebKit/pull/38436
EWS
Committed 288339@main (448746e32905): <https://commits.webkit.org/288339@main>
Reviewed commits have been landed. Closing PR #38436 and removing active labels.
Radar WebKit Bug Importer
<rdar://problem/142197604>