ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
https://bugs.webkit.org/show_bug.cgi?id=162003
Patch by Joseph Pecoraro <pecoraro@apple.com> on 2016-09-14
Reviewed by Saam Barati.
JSTests:
* stress/spread-calling.js:
* test262.yaml:
Source/JavaScriptCore:
* bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::isSimpleArray):
Don't treat an Array that has a spread expression inside it as simple.
This avoids a fast path for f.apply(x, simpleArray) that was not handling
spread expressions within arrays, and instead taking a path that can
handle the spreading.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@205944 268f45cc-cd09-0410-ab3c-d52691b4dbfc
5 files changed
