Changeset 64773 in webkit

Timestamp:

Aug 5, 2010 12:33:42 PM (14 years ago)

Author:

commit-queue@webkit.org

Message:

2010-08-05 Michael Saboff <​msaboff@apple.com>

Reviewed by Darin Adler.

Fixed ​https://bugs.webkit.org/show_bug.cgi?id=43401 where array
content aren't properly initialized as part of unshift.

• runtime/JSArray.cpp: (JSC::JSArray::unshiftCount):

2010-08-05 Michael Saboff <​msaboff@apple.com>

Reviewed by Darin Adler.

New regression tests added as part of unshift fix for bug described
inhttps://bugs.webkit.org/show_bug.cgi?id=43401.

• fast/js/script-tests/unshift-multi.js: Added.
• fast/js/unshift-multi-expected.txt: Added.
• fast/js/unshift-multi.html: Added.

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/runtime/JSArray.cpp (modified) (1 diff)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/script-tests/unshift-multi.js (added)
• LayoutTests/fast/js/unshift-multi-expected.txt (added)
• LayoutTests/fast/js/unshift-multi.html (added)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2010-08-05  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=43401 where array 
+        content aren't properly initialized as part of unshift.  
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCount):
+
 2010-08-05  Jian Li  <jianli@chromium.org>
 

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -851 +851 @@
         setArrayStorage(storage);
         m_vectorLength += count;
-    } else if ((!m_indexBias) && (!increaseVectorPrefixLength(m_vectorLength + count))) {
+    } else if (!increaseVectorPrefixLength(m_vectorLength + count)) {
         throwOutOfMemoryError(exec);
         return;
     }
+
+    for (int i = 0; i < count; i++)
+        m_vector[i] = JSValue();
 }
 

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-08-05  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        New regression tests added as part of unshift fix for bug described
+        inhttps://bugs.webkit.org/show_bug.cgi?id=43401.
+
+        * fast/js/script-tests/unshift-multi.js: Added.
+        * fast/js/unshift-multi-expected.txt: Added.
+        * fast/js/unshift-multi.html: Added.
+
 2010-08-05  Martin Robinson  <mrobinson@igalia.com>