[JSC] OrdinarySet should invoke custom [[Set]] methods for indexed puts
Created attachment 451306 [details] Patch
Created attachment 451388 [details] Patch Adjust tests.
Comment on attachment 451388 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=451388&action=review > Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:405 > + if (UNLIKELY(slot.thisValue() != thisObject)) { can we do the "isThisValueAltered" thing? > Source/JavaScriptCore/runtime/JSObject.cpp:2899 > + if (current->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) { this is bizarre that we're using this flag to indicate what to do for put. This feels like an inconsistent fix to me. > Source/JavaScriptCore/runtime/StructureInlines.h:93 > + if (typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) > + return true; this is not the intention of this flag. Now, if you put a typed array in a prototype chain, you're going to "have a bad time". Why is this needed?
<rdar://problem/88988175>