RESOLVED FIXED Bug 19442
JavaScript array implementation doesn't maintain m_numValuesInVector when sorting 
https://bugs.webkit.org/show_bug.cgi?id=19442
Summary JavaScript array implementation doesn't maintain m_numValuesInVector when sor...
Darin Adler
Reported 2008-06-08 18:25:26 PDT
I have a patch that add some consistency checks and fixes this issue.
Attachments
patch (13.50 KB, patch)
2008-06-08 19:17 PDT, Darin Adler 		ap: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Darin Adler
Comment 1 2008-06-08 19:17:30 PDT
Created attachment 21586 [details] patch
Alexey Proskuryakov
Comment 2 2008-06-09 20:17:31 PDT
Comment on attachment 21586 [details] patch r=me
Darin Adler
Comment 3 2008-06-11 12:39:00 PDT
Committed revision 34496.
Note You need to log in before you can comment on or make changes to this bug.