Revert "Merge r235356 - [JSC] Array.prototype.reverse modifies JSImmu…

…tableButterfly"

This reverts commit 729388b8e4bc924eacddcb4e40e0e2ae41588085.

This commit had already been backported in r236061, but was missing the 'Merged' in the commit message so I failed to find it. All I managed to accomplish here was duplicating the ChangeLog entries.

JSTests/ChangeLog

@@ -8,19 +8,6 @@
 
         * stress/regress-189571.js: Added.
 
-2018-08-24  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
-
-        [JSC] Array.prototype.reverse modifies JSImmutableButterfly
-        https://bugs.webkit.org/show_bug.cgi?id=188794
-
-        Reviewed by Saam Barati.
-
-        * stress/reverse-with-immutable-butterfly.js: Added.
-        (shouldBe):
-        (reverseInt):
-        (reverseDouble):
-        (reverseContiguous):
-
 2018-11-15  Mark Lam  <mark.lam@apple.com>
 
         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.

Source/JavaScriptCore/ChangeLog

@@ -176,23 +176,6 @@
         (JSC::IndexedForInContext::IndexedForInContext):
         (JSC::ForInContext::~ForInContext): Deleted.
 
-2018-08-24  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
-
-        [JSC] Array.prototype.reverse modifies JSImmutableButterfly
-        https://bugs.webkit.org/show_bug.cgi?id=188794
-
-        Reviewed by Saam Barati.
-
-        While Array.prototype.reverse modifies the butterfly of the given Array,
-        it does not account JSImmutableButterfly case. So it accidentally modifies
-        the content of JSImmutableButterfly.
-        This patch converts CoW arrays to writable arrays before reversing.
-
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncReverse):
-        * runtime/JSObject.h:
-        (JSC::JSObject::ensureWritable):
-
 2018-11-15  Mark Lam  <mark.lam@apple.com>
 
         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.