Don't assume spread element is fast mode

Signed-off-by: Seonghyun Kim <sh8281.kim@samsung.com>
This commit is contained in:
Seonghyun Kim 2026-05-26 20:42:07 +09:00 committed by MuHong Byun
commit 3b43994a7d
2 changed files with 10 additions and 6 deletions

View file

@ -4333,9 +4333,14 @@ NEVER_INLINE void InterpreterSlowPath::spreadFunctionArguments(ExecutionState& s
Value arg = argv[i];
if (arg.isObject() && arg.asObject()->isSpreadArray()) {
ArrayObject* spreadArray = arg.asObject()->asArrayObject();
ASSERT(spreadArray->isFastModeArray());
for (size_t i = 0; i < spreadArray->arrayLength(state); i++) {
argVector.push_back(spreadArray->m_fastModeData[i]);
if (spreadArray->isFastModeArray()) {
for (size_t i = 0; i < spreadArray->arrayLength(state); i++) {
argVector.push_back(spreadArray->m_fastModeData[i]);
}
} else {
for (size_t i = 0; i < spreadArray->arrayLength(state); i++) {
argVector.push_back(spreadArray->getOwnProperty(state, ObjectPropertyName(state, i)).value(state, spreadArray));
}
}
} else {
argVector.push_back(arg);
@ -4682,10 +4687,9 @@ NEVER_INLINE void InterpreterSlowPath::arrayDefineOwnPropertyBySpreadElementOper
Value element = registerFile[loadRegisterIndexs[i]];
if (element.isObject() && element.asObject()->isSpreadArray()) {
ArrayObject* spreadArray = element.asObject()->asArrayObject();
ASSERT(spreadArray->isFastModeArray());
Value spreadElement;
for (size_t spreadIndex = 0; spreadIndex < spreadArray->arrayLength(state); spreadIndex++) {
spreadElement = spreadArray->m_fastModeData[spreadIndex];
spreadElement = spreadArray->getOwnProperty(state, ObjectPropertyName(state, spreadIndex)).value(state, spreadArray);
arr->defineOwnProperty(state, ObjectPropertyName(state, baseIndex + elementIndex), ObjectPropertyDescriptor(spreadElement, ObjectPropertyDescriptor::AllPresent));
elementIndex++;
}

@ -1 +1 @@
Subproject commit 48d330ff01dca5b8238a0c92f9d212ac05620b62
Subproject commit ff0449a235a7a2a9f9019f5bea44cf5e3c80fc02