iOS12中的Safari会缓存数组状态

<a rel="noreferrer">It's definitely a BUG!</a>&nbsp; And it's a very serious bug.<br> Per my testing, the bug is due to the optimization of array initializers in which all values are primitive literals. For example, <code>() =&gt; [1, null, 'x']</code> will result in such an array; all returned array references from this lambda will link to the same memory address, and some method like <code>toString()</code> will be cached. Normally, any mutable operation on such arrays will copy the data to a separate memory space and link to it; this is called <a rel="noreferrer">copy-on-write</a>&nbsp;, or CoW for short.<br> The <code>reverse()</code> method mutates the array, so it should trigger a copy-on-write. Apparently, it no longer does so, which causes the bug you’re seeing.<br> On the other hand, all methods which do not modify the array should not trigger CoW, and I’ve found that even <code>a.fill(value, 0, 0)</code> or <code>a.copyWithin(index, 0, 0)</code> won't trigger CoW because such callings don't really mutate the array. But I noticed that <code>a.slice()</code> WILL trigger CoW. <del>So, if I had to guess, I’d say the underlying cause of this bug may be that someone accidentally swapped the indices of <code>slice</code> and <code>reverse</code>.</del><em>My guess is not correct, the original author (Keith Miller @ Apple) just simply miss the <code>reverse()</code> case though he already wrote many test cases. <code>slice()</code> is a separate story, may be related to fastSlice optimization though I still don't understand the reason. Anyway, unnecessary CoW won't cause bug.</em><br>