Bug 139598

Summary: Splice not removing a sparse element from a JSArray
Product: WebKit Reporter: Matthew Mirman <mmirman>
Component: JavaScriptCoreAssignee: Matthew Mirman <mmirman>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, fpizlo, ggaren, mmirman
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
shiftCountWithArrayStorage should exit to slow path when object has sparse map none

Matthew Mirman
Reported 2014-12-12 14:53:22 PST
<rdar://problem/18779367> Patch Forthcoming.
Attachments
shiftCountWithArrayStorage should exit to slow path when object has sparse map (1.98 KB, patch)
2014-12-12 15:00 PST, Matthew Mirman 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Matthew Mirman
Comment 1 2014-12-12 15:00:48 PST
Created attachment 243221 [details] shiftCountWithArrayStorage should exit to slow path when object has sparse map
WebKit Commit Bot
Comment 2 2014-12-12 15:45:33 PST
Comment on attachment 243221 [details] shiftCountWithArrayStorage should exit to slow path when object has sparse map Clearing flags on attachment: 243221 Committed r177245: <http://trac.webkit.org/changeset/177245>
WebKit Commit Bot
Comment 3 2014-12-12 15:45:36 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.