Let's use Ryosuke's JSArray::fastSlice() for Array.prototype.splice() too :-)
Created attachment 253584 [details] Patch
Comment on attachment 253584 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=253584&action=review > Source/JavaScriptCore/runtime/ArrayPrototype.cpp:669 > + for (unsigned k = 0; k < deleteCount; k++) { ++k > Source/JavaScriptCore/runtime/JSArray.cpp:684 > + case ALL_INT32_INDEXING_TYPES: > + case ALL_DOUBLE_INDEXING_TYPES: > + case ALL_CONTIGUOUS_INDEXING_TYPES: { I don't think that changes anything, fastSlice() always happen after isJSArray().
Created attachment 253585 [details] Patch for landing
Comment on attachment 253585 [details] Patch for landing Clearing flags on attachment: 253585 Committed r184767: <http://trac.webkit.org/changeset/184767>
All reviewed patches have been landed. Closing bug.
*** Bug 145302 has been marked as a duplicate of this bug. ***