Unreviewed, fix build failure on ARM64_32

https://bugs.webkit.org/show_bug.cgi?id=182434

Implicit narrowing from uint64_t to uint32_t happens. We should explicitly narrow it because we already checked
the `length` is <= UINT32_MAX.

* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncSpeciesCreate):

Canonical link: https://commits.webkit.org/213438@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@247175 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,14 @@
+2019-07-05  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Unreviewed, fix build failure on ARM64_32
+        https://bugs.webkit.org/show_bug.cgi?id=182434
+
+        Implicit narrowing from uint64_t to uint32_t happens. We should explicitly narrow it because we already checked
+        the `length` is <= UINT32_MAX.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSpeciesCreate):
+
 2019-07-05  Alexey Shvayka  <shvaikalesh@gmail.com>
 
         [JSC] Clean up ArraySpeciesCreate

Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -284,7 +284,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSpeciesCreate(ExecState* exec)
         return { };
     }
 
-    RELEASE_AND_RETURN(scope, JSValue::encode(constructEmptyArray(exec, nullptr, length)));
+    RELEASE_AND_RETURN(scope, JSValue::encode(constructEmptyArray(exec, nullptr, static_cast<unsigned>(length))));
 }
 
 static inline unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument, unsigned length, unsigned undefinedValue = 0)