Bug 19442 - JavaScript array implementation doesn't maintain m_numValuesInVector when sorting
Summary: JavaScript array implementation doesn't maintain m_numValuesInVector when sor...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Normal
Assignee: Darin Adler
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-06-08 18:25 PDT by Darin Adler
Modified: 2008-06-11 12:39 PDT (History)
0 users

See Also:


Attachments
patch (13.50 KB, patch)
2008-06-08 19:17 PDT, Darin Adler
ap: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Darin Adler 2008-06-08 18:25:26 PDT
I have a patch that add some consistency checks and fixes this issue.
Comment 1 Darin Adler 2008-06-08 19:17:30 PDT
Created attachment 21586 [details]
patch
Comment 2 Alexey Proskuryakov 2008-06-09 20:17:31 PDT
Comment on attachment 21586 [details]
patch

r=me
Comment 3 Darin Adler 2008-06-11 12:39:00 PDT
Committed revision 34496.