tree b4a7fea0322d54a4016284356587938147e0cb8d
parent 6ca867622a76c518c46b5c21da535a885afce7e4
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1642204126 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1642204126 +0000

JSArray::fastSlice() should not convert the source from CoW
https://bugs.webkit.org/show_bug.cgi?id=234990

Patch by Alexey Shvayka <ashvayka@apple.com> on 2022-01-14
Reviewed by Yusuke Suzuki.

JSTests:

* stress/array-slice-cow.js:

Source/JavaScriptCore:

Since we aren't modifying the source array in fastSlice() nor its slow path,
there is no reason to convert it from CopyOnWrite.

* runtime/JSArray.cpp:
(JSC::JSArray::fastSlice):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@288036 268f45cc-cd09-0410-ab3c-d52691b4dbfc