Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(368)

Unified Diff: src/builtins/builtins-array.cc

Issue 2527173002: [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS (Closed)
Patch Set: Created 4 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-668414.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/builtins/builtins-array.cc
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index 19cab23bbfbc7c0a8750c1bda28e46774039465c..2ea113da5f6a9a3ee5a9b3b12cbbdb71230d0250 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -991,8 +991,9 @@ Object* Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
// If estimated number of elements is more than half of length, a
// fixed array (fast case) is more time and space-efficient than a
// dictionary.
- bool fast_case =
- is_array_species && (estimate_nof_elements * 2) >= estimate_result_length;
+ bool fast_case = is_array_species &&
+ (estimate_nof_elements * 2) >= estimate_result_length &&
+ isolate->IsIsConcatSpreadableLookupChainIntact();
if (fast_case && kind == FAST_DOUBLE_ELEMENTS) {
Handle<FixedArrayBase> storage =
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-668414.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698