Title: [239000] releases/WebKitGTK/webkit-2.22
- Revision
- 239000
- Author
- [email protected]
- Date
- 2018-12-07 17:19:51 -0800 (Fri, 07 Dec 2018)
Log Message
Revert "Merge r235356 - [JSC] Array.prototype.reverse modifies JSImmutableButterfly"
This reverts commit 729388b8e4bc924eacddcb4e40e0e2ae41588085.
This commit had already been backported in r236061, but was missing the 'Merged' in the commit message so I failed to find it. All I managed to accomplish here was duplicating the ChangeLog entries.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog (238999 => 239000)
--- releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog 2018-12-08 01:19:49 UTC (rev 238999)
+++ releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog 2018-12-08 01:19:51 UTC (rev 239000)
@@ -8,19 +8,6 @@
* stress/regress-189571.js: Added.
-2018-08-24 Yusuke Suzuki <[email protected]>
-
- [JSC] Array.prototype.reverse modifies JSImmutableButterfly
- https://bugs.webkit.org/show_bug.cgi?id=188794
-
- Reviewed by Saam Barati.
-
- * stress/reverse-with-immutable-butterfly.js: Added.
- (shouldBe):
- (reverseInt):
- (reverseDouble):
- (reverseContiguous):
-
2018-11-15 Mark Lam <[email protected]>
RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog (238999 => 239000)
--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog 2018-12-08 01:19:49 UTC (rev 238999)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog 2018-12-08 01:19:51 UTC (rev 239000)
@@ -176,23 +176,6 @@
(JSC::IndexedForInContext::IndexedForInContext):
(JSC::ForInContext::~ForInContext): Deleted.
-2018-08-24 Yusuke Suzuki <[email protected]>
-
- [JSC] Array.prototype.reverse modifies JSImmutableButterfly
- https://bugs.webkit.org/show_bug.cgi?id=188794
-
- Reviewed by Saam Barati.
-
- While Array.prototype.reverse modifies the butterfly of the given Array,
- it does not account JSImmutableButterfly case. So it accidentally modifies
- the content of JSImmutableButterfly.
- This patch converts CoW arrays to writable arrays before reversing.
-
- * runtime/ArrayPrototype.cpp:
- (JSC::arrayProtoFuncReverse):
- * runtime/JSObject.h:
- (JSC::JSObject::ensureWritable):
-
2018-11-15 Mark Lam <[email protected]>
RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
