Bug 159641

Summary: some paths in Array.prototype.splice don't account for the array not having certain indexed properties
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, oliver, sukolsak, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch fpizlo: review+

Saam Barati
Reported 2016-07-11 12:59:00 PDT
...
Attachments
patch (4.38 KB, patch)
2016-07-11 14:47 PDT, Saam Barati 		fpizlo: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2016-07-11 12:59:33 PDT
<rdar://problem/27171999>
Saam Barati
Comment 2 2016-07-11 14:47:37 PDT
Created attachment 283348 [details] patch
Saam Barati
Comment 3 2016-07-11 15:09:47 PDT
landed in: https://trac.webkit.org/changeset/203087
Note You need to log in before you can comment on or make changes to this bug.