From 3adde3f13f23666956f631aadcdcf1860fed1fa5 Mon Sep 17 00:00:00 2001 From: Atul Katti Date: Wed, 11 Sep 2019 11:42:49 -0700 Subject: [PATCH] Fixes #6031 The assert itself doesn't repro. However, ReverseHelper fails to recognize that this could be a TypedArray and seems to fail earlier than it should unable to find the Reverse method. --- lib/Runtime/Library/JavascriptArray.cpp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/Runtime/Library/JavascriptArray.cpp b/lib/Runtime/Library/JavascriptArray.cpp index a356132c9d4..8d1d214c008 100644 --- a/lib/Runtime/Library/JavascriptArray.cpp +++ b/lib/Runtime/Library/JavascriptArray.cpp @@ -5600,8 +5600,14 @@ using namespace Js; Var lowerValue = nullptr, upperValue = nullptr; T lowerExists, upperExists; const char16* methodName; - bool isTypedArrayEntryPoint = typedArrayBase != nullptr; + // If we came from Array.prototype.map and source object is not a JavascriptArray, source could be a TypedArray + if (typedArrayBase == nullptr && pArr == nullptr && VarIs(obj)) + { + typedArrayBase = UnsafeVarTo(obj); + } + + bool isTypedArrayEntryPoint = typedArrayBase != nullptr; if (isTypedArrayEntryPoint) { methodName = _u("[TypedArray].prototype.reverse"); @@ -5611,12 +5617,6 @@ using namespace Js; methodName = _u("Array.prototype.reverse"); } - // If we came from Array.prototype.map and source object is not a JavascriptArray, source could be a TypedArray - if (!isTypedArrayEntryPoint && pArr == nullptr && VarIs(obj)) - { - typedArrayBase = UnsafeVarTo(obj); - } - ThrowTypeErrorOnFailureHelper h(scriptContext, methodName); bool useNoSideEffectReverse = pArr != nullptr && !HasAnyES5ArrayInPrototypeChain(pArr);