haikuwebkit/LayoutTests/js/regress-155776.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-155776.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
JavaScriptCore ArrayPrototype::join shouldn't cache butterfly when it makes effectful calls https://bugs.webkit.org/show_bug.cgi?id=155776 Reviewed by Saam Barati. Source/JavaScriptCore: Array.join ends up calling toString, possibly on some object. Since these calls could be effectful and could change the array itself, we can't hold the butterfly pointer while making effectful calls. Changed the code to fall back to the general case when an effectful toString() call might be made. * runtime/ArrayPrototype.cpp: (JSC::join): * runtime/JSStringJoiner.h: (JSC::JSStringJoiner::appendWithoutSideEffects): New helper that doesn't make effectful toString() calls. (JSC::JSStringJoiner::append): Built upon appendWithoutSideEffects. LayoutTests: New test. * js/regress-155776-expected.txt: Added. * js/regress-155776.html: Added. * js/script-tests/regress-155776.js: Added. (fillBigArrayViaToString): (Function.prototype.toString): Canonical link: https://commits.webkit.org/173907@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@198592 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2016-03-23 21:03:02 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-155776.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`