Bug 25227 - Array.filter triggers an assertion when the target array shrinks while being filtered
Summary: Array.filter triggers an assertion when the target array shrinks while being ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Normal
Assignee: Oliver Hunt
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-04-15 18:56 PDT by Oliver Hunt
Modified: 2009-04-15 19:12 PDT (History)
0 users

See Also:


Attachments
filter fixeration (114.16 KB, patch)
2009-04-15 19:04 PDT, Oliver Hunt
barraclough: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2009-04-15 18:56:57 PDT
Array.filter uses unguarded accesses to array elements, but alas the array may be shrunk by the filter function, thus leading to badness
Comment 1 Oliver Hunt 2009-04-15 19:04:04 PDT
Created attachment 29523 [details]
filter fixeration
Comment 2 Oliver Hunt 2009-04-15 19:12:52 PDT
Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/runtime/ArrayPrototype.cpp
	M	LayoutTests/ChangeLog
	A	LayoutTests/fast/js/array-enumerators-functions-expected.txt
	A	LayoutTests/fast/js/array-enumerators-functions.html
	A	LayoutTests/fast/js/resources/array-enumerators-functions.js
Committed r42567