Bug 19442

Summary: JavaScript array implementation doesn't maintain m_numValuesInVector when sorting
Product: WebKit Reporter: Darin Adler <darin>
Component: JavaScriptCoreAssignee: Darin Adler <darin>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
patch ap: review+

Darin Adler
Reported 2008-06-08 18:25:26 PDT
I have a patch that add some consistency checks and fixes this issue.
Attachments
patch (13.50 KB, patch)
2008-06-08 19:17 PDT, Darin Adler 		ap: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Darin Adler
Comment 1 2008-06-08 19:17:30 PDT
Created attachment 21586 [details] patch
Alexey Proskuryakov
Comment 2 2008-06-09 20:17:31 PDT
Comment on attachment 21586 [details] patch r=me
Darin Adler
Comment 3 2008-06-11 12:39:00 PDT
Committed revision 34496.
Note You need to log in before you can comment on or make changes to this bug.