Title: [91580] branches/safari-534.51-branch/Source/_javascript_Core
Diff
Modified: branches/safari-534.51-branch/Source/_javascript_Core/ChangeLog (91579 => 91580)
--- branches/safari-534.51-branch/Source/_javascript_Core/ChangeLog 2011-07-22 18:28:33 UTC (rev 91579)
+++ branches/safari-534.51-branch/Source/_javascript_Core/ChangeLog 2011-07-22 18:30:13 UTC (rev 91580)
@@ -1,5 +1,22 @@
2011-07-22 Lucas Forschler <[email protected]>
+ Merged 90282.
+
+ 2011-07-01 Oliver Hunt <[email protected]>
+
+ IE Web Workers demo crashes in JSC::SlotVisitor::visitChildren()
+ https://bugs.webkit.org/show_bug.cgi?id=63732
+
+ Reviewed by Gavin Barraclough.
+
+ Initialise the memory at the head of the new storage so that
+ GC is safe if triggered by reportExtraMemoryCost.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::increaseVectorPrefixLength):
+
+2011-07-22 Lucas Forschler <[email protected]>
+
Merged 89614.
2011-07-01 Oliver Hunt <[email protected]>
Modified: branches/safari-534.51-branch/Source/_javascript_Core/runtime/JSArray.cpp (91579 => 91580)
--- branches/safari-534.51-branch/Source/_javascript_Core/runtime/JSArray.cpp 2011-07-22 18:28:33 UTC (rev 91579)
+++ branches/safari-534.51-branch/Source/_javascript_Core/runtime/JSArray.cpp 2011-07-22 18:30:13 UTC (rev 91580)
@@ -638,7 +638,10 @@
m_vectorLength = newLength;
fastFree(storage->m_allocBase);
-
+ ASSERT(newLength > vectorLength);
+ unsigned delta = newLength - vectorLength;
+ for (unsigned i = 0; i < delta; i++)
+ m_storage->m_vector[i].clear();
Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
