Changeset 36106

Timestamp:

09/04/08 20:11:54 (3 months ago)

Author:

ggaren@apple.com

Message:

2008-09-04 Gavin Barraclough <barraclough@apple.com>

Reviewed by Geoffrey Garen.

Fixed an off-by-one error that would cause the StructureIDChain to
be one object too short.

Can't construct a test case because other factors make this not crash
(yet!).

• kjs/StructureID.cpp: (KJS::StructureIDChain::StructureIDChain):

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• kjs/StructureID.cpp (modified) (2 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed an off-by-one error that would cause the StructureIDChain to
+        be one object too short.
+        
+        Can't construct a test case because other factors make this not crash
+        (yet!).
+
+        * kjs/StructureID.cpp:
+        (KJS::StructureIDChain::StructureIDChain):
+
 2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
 

trunk/JavaScriptCore/kjs/StructureID.cpp

@@ -110 +110 @@
 StructureIDChain::StructureIDChain(StructureID* structureID)
 {
-    size_t size = 0;
+    size_t size = 1;
 
     StructureID* tmp = structureID;
@@ -117 +117 @@
         tmp = static_cast<JSCell*>(tmp->prototype())->structureID();
     }
-
+    
     m_vector.set(new RefPtr<StructureID>[size]);
 
-    for (size_t i = 0; i < size; ++i) {
+    size_t i;
+    for (i = 0; i < size - 1; ++i) {
         m_vector[i] = structureID;
         structureID = static_cast<JSObject*>(structureID->prototype())->structureID();
     }
+    m_vector[i] = structureID;
 }