Bug 247480 – JSTests/stress/array-isarray-error-message.js fails when run with --useJIT=0

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

isArraySlowInline() was checking if a function is Object.prototype.toString by testing for function->intrinsic() == ObjectToStringIntrinsic.  However, this only works when the JIT is enabled.  When the JIT is disabled, function->intrinsic() is always NoIntrinsic.

The fix is to test function against globalObject->m_objectProtoToStringFunction instead.  However, globalObject->m_objectProtoToStringFunction is a LazyProperty.  We don't want this check to trigger the initialization of that LazyProperty, nor do we need to.  Simply testing against its pointer value is sufficient.  The only way the function can be Object.prototype.toString is if that LazyProperty has already been initialized.  If it's not initialized yet, then function cannot be Object.prototype.toString.  To enable this test, we'll introduce JSGlobal::objectProtoToStringFunctionConcurrently().

<rdar://problem/101942000>

[Mark Lam]

Pull request: https://github.com/WebKit/WebKit/pull/6127

[EWS]

Committed 256314@main (5551d9ec0813): <https://commits.webkit.org/256314@main>

Reviewed commits have been landed. Closing PR #6127 and removing active labels.