Bug 139598

Summary: Splice not removing a sparse element from a JSArray
Product: WebKit Reporter: Matthew Mirman <mmirman>
Component: JavaScriptCoreAssignee: Matthew Mirman <mmirman>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, fpizlo, ggaren, mmirman
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
shiftCountWithArrayStorage should exit to slow path when object has sparse map none

Description Matthew Mirman 2014-12-12 14:53:22 PST 
<rdar://problem/18779367>

Patch Forthcoming.
Comment 1 Matthew Mirman 2014-12-12 15:00:48 PST 
Created attachment 243221 [details]
shiftCountWithArrayStorage should exit to slow path when object has sparse map
Comment 2 WebKit Commit Bot 2014-12-12 15:45:33 PST 
Comment on attachment 243221 [details]
shiftCountWithArrayStorage should exit to slow path when object has sparse map

Clearing flags on attachment: 243221

Committed r177245: <http://trac.webkit.org/changeset/177245>
Comment 3 WebKit Commit Bot 2014-12-12 15:45:36 PST 
All reviewed patches have been landed.  Closing bug.