Bug 121717

Summary: (un)shiftCountWithAnyIndexingType will start over in the middle of copying if it sees a hole
Product: WebKit Reporter: Mark Hahnenberg <mhahnenberg>
Component: JavaScriptCoreAssignee: Mark Hahnenberg <mhahnenberg>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, rniwa
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 125944    
Attachments:
Description Flags
Patch none

Mark Hahnenberg
Reported 2013-09-20 14:26:05 PDT
This then causes the array to become corrupted. Instead we should check for holes before we start moving things, and start moving things only once we've determined that there are none.
Attachments
Patch (10.27 KB, patch)
2013-09-20 15:08 PDT, Mark Hahnenberg 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Mark Hahnenberg
Comment 1 2013-09-20 15:08:09 PDT
Created attachment 212227 [details] Patch
WebKit Commit Bot
Comment 2 2013-09-20 17:23:02 PDT
Comment on attachment 212227 [details] Patch Clearing flags on attachment: 212227 Committed r156214: <http://trac.webkit.org/changeset/156214>
WebKit Commit Bot
Comment 3 2013-09-20 17:23:04 PDT
All reviewed patches have been landed. Closing bug.
Mark Hahnenberg
Comment 4 2013-09-20 17:25:02 PDT
<rdar://problem/15044692>
Ryosuke Niwa
Comment 5 2013-12-20 17:33:30 PST
This patch caused https://bugs.webkit.org/show_bug.cgi?id=125944
Note You need to log in before you can comment on or make changes to this bug.