Title: [148473] branches/safari-536.30-branch/Source/_javascript_Core
- Revision
- 148473
- Author
- [email protected]
- Date
- 2013-04-15 15:56:18 -0700 (Mon, 15 Apr 2013)
Log Message
Merged r141029. <rdar://problem/13334878>
Modified Paths
Diff
Modified: branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog (148472 => 148473)
--- branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog 2013-04-15 22:26:03 UTC (rev 148472)
+++ branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog 2013-04-15 22:56:18 UTC (rev 148473)
@@ -1,3 +1,26 @@
+2013-04-15 Lucas Forschler <[email protected]>
+
+ Merge r141029
+
+ 2013-01-28 Oliver Hunt <[email protected]>
+
+ Add more assertions to the property storage use in arrays
+ https://bugs.webkit.org/show_bug.cgi?id=107728
+
+ Reviewed by Filip Pizlo.
+
+ Add a bunch of assertions to array and object butterfly
+ usage. This should make debugging somewhat easier.
+
+ I also converted a couple of assertions to release asserts
+ as they were so low cost it seemed a sensible thing to do.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::sortVector):
+ (JSC::JSArray::compactForSorting):
+ * runtime/JSObject.h:
+ (JSC::JSObject::getHolyIndexQuickly):
+
2013-04-14 David Kilzer <[email protected]>
Revert "Attempt to fix Windows build after r148370"
Modified: branches/safari-536.30-branch/Source/_javascript_Core/runtime/JSArray.cpp (148472 => 148473)
--- branches/safari-536.30-branch/Source/_javascript_Core/runtime/JSArray.cpp 2013-04-15 22:26:03 UTC (rev 148472)
+++ branches/safari-536.30-branch/Source/_javascript_Core/runtime/JSArray.cpp 2013-04-15 22:56:18 UTC (rev 148473)
@@ -1631,7 +1631,7 @@
// Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
for (; numDefined < usedVectorLength; ++numDefined) {
- if (numDefined > m_vectorLength)
+ if (numDefined >= m_vectorLength)
break;
JSValue v = m_storage->m_vector[numDefined].get();
if (!v || v.isUndefined())
@@ -1640,7 +1640,7 @@
tree.insert(numDefined);
}
for (unsigned i = numDefined; i < usedVectorLength; ++i) {
- if (i > m_vectorLength)
+ if (i >= m_vectorLength)
break;
JSValue v = m_storage->m_vector[i].get();
if (v) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
