Bug 280381 – [JSC] Check if the species watchpoint is valid before `array.concat()` fast path

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Sosuke Suzuki]

The Array.prototype.concat test262 started failing due to https://commits.webkit.org/284060@main.
    This was because the species check was not performed before entering the fast path.

------

! NEW FAIL test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js (strict mode)
Exception: Test262Error: Object.getPrototypeOf(array.concat()) returns CustomCtor.prototype Expected SameValue(«», «[object Object]») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-non-object.js (strict mode)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js (default)
Exception: Test262Error: Object.getPrototypeOf(array.concat()) returns CustomCtor.prototype Expected SameValue(«», «[object Object]») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-non-object.js (default)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-non-ctor.js (strict mode)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-non-ctor.js (default)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-poisoned.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-poisoned.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species.js (strict mode)
Exception: Test262Error: The value of callCount is expected to be 1 Expected SameValue(«0», «1») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-species.js (default)
Exception: Test262Error: The value of callCount is expected to be 1 Expected SameValue(«0», «1») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-abrupt.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-poisoned.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-abrupt.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-poisoned.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

[Sosuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/34276

[EWS]

Committed 284330@main (e7aeca7171e3): <https://commits.webkit.org/284330@main>

Reviewed commits have been landed. Closing PR #34276 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/136801197>

[Yusuke Suzuki]

*** Bug 281061 has been marked as a duplicate of this bug. ***