RESOLVED FIXED314582
[JSC] Array ToPrimitive fast path ignores Array.prototype.valueOf override 
https://bugs.webkit.org/show_bug.cgi?id=314582
Summary [JSC] Array ToPrimitive fast path ignores Array.prototype.valueOf override
Kai Tamkun
Reported 2026-05-11 14:39:42 PDT
See https://github.com/WebKit/WebKit/pull/63524. Array.prototype.valueOf is also affected, not just Object.prototype.valueOf.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-05-11 14:39:48 PDT
<rdar://problem/176823624>
Kai Tamkun
Comment 2 2026-05-11 15:23:43 PDT
Pull request: https://github.com/WebKit/WebKit/pull/64704
EWS
Comment 3 2026-05-28 10:12:25 PDT
Committed 314056@main (8a7e39c2bf81): <https://commits.webkit.org/314056@main> Reviewed commits have been landed. Closing PR #64704 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.