RESOLVED FIXED 285254
[JSC] `Array.prototype.toReversed` should fill holes with undefined 
https://bugs.webkit.org/show_bug.cgi?id=285254
Summary [JSC] `Array.prototype.toReversed` should fill holes with undefined
Sosuke Suzuki
Reported 2024-12-30 20:36:42 PST
https://commits.webkit.org/287431@main rewrote `Array.prototype.toReversed` in C++. According to the spec[1], `toReversed` should fill holes with `undefined`, but this C++ implementation sometimes leaves those holes intact. This commit fixes that issue by making the function bail out from the fast path when the array contains any holes. [1]: https://tc39.es/ecma262/#sec-array.prototype.toreversed
Attachments
Add attachment proposed patch, testcase, etc.
Sosuke Suzuki
Comment 1 2024-12-30 20:37:20 PST
Pull request: https://github.com/WebKit/WebKit/pull/38436
EWS
Comment 2 2024-12-30 22:18:57 PST
Committed 288339@main (448746e32905): <https://commits.webkit.org/288339@main> Reviewed commits have been landed. Closing PR #38436 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2024-12-30 22:19:15 PST
<rdar://problem/142197604>
Note You need to log in before you can comment on or make changes to this bug.