Bug 217634 - Array.prototype.sort's sortBucketSort accesses an array in an invalid way that can lead to incorrect results with indexed properties on the prototype chain
Summary: Array.prototype.sort's sortBucketSort accesses an array in an invalid way tha...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
: 217516 (view as bug list)
Depends on:
Blocks:
 
Reported: 2020-10-12 14:28 PDT by Saam Barati
Modified: 2020-10-12 16:21 PDT (History)
18 users (show)

See Also:

Attachments
patch (3.13 KB, patch)
2020-10-12 14:53 PDT, Saam Barati 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2020-10-12 14:28:21 PDT 
...
Comment 1 Saam Barati 2020-10-12 14:28:53 PDT 
<rdar://problem/69489404>
Comment 2 Saam Barati 2020-10-12 14:53:50 PDT 
Created attachment 411162 [details]
patch
Comment 3 Yusuke Suzuki 2020-10-12 14:56:37 PDT 
Comment on attachment 411162 [details]
patch

r=me
Comment 4 Saam Barati 2020-10-12 16:13:51 PDT 
*** Bug 217516 has been marked as a duplicate of this bug. ***
Comment 5 EWS 2020-10-12 16:21:29 PDT 
Committed r268375: <https://trac.webkit.org/changeset/268375>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 411162 [details].