RESOLVED FIXED 121717
(un)shiftCountWithAnyIndexingType will start over in the middle of copying if it sees a hole 
https://bugs.webkit.org/show_bug.cgi?id=121717
Summary (un)shiftCountWithAnyIndexingType will start over in the middle of copying if...
Mark Hahnenberg
Reported 2013-09-20 14:26:05 PDT
This then causes the array to become corrupted. Instead we should check for holes before we start moving things, and start moving things only once we've determined that there are none.
Attachments
Patch (10.27 KB, patch)
2013-09-20 15:08 PDT, Mark Hahnenberg 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Mark Hahnenberg
Comment 1 2013-09-20 15:08:09 PDT
Created attachment 212227 [details] Patch
WebKit Commit Bot
Comment 2 2013-09-20 17:23:02 PDT
Comment on attachment 212227 [details] Patch Clearing flags on attachment: 212227 Committed r156214: <http://trac.webkit.org/changeset/156214>
WebKit Commit Bot
Comment 3 2013-09-20 17:23:04 PDT
All reviewed patches have been landed. Closing bug.
Mark Hahnenberg
Comment 4 2013-09-20 17:25:02 PDT
<rdar://problem/15044692>
Ryosuke Niwa
Comment 5 2013-12-20 17:33:30 PST
This patch caused https://bugs.webkit.org/show_bug.cgi?id=125944
Note You need to log in before you can comment on or make changes to this bug.