Array.filter uses unguarded accesses to array elements, but alas the array may be shrunk by the filter function, thus leading to badness
Created attachment 29523 [details] filter fixeration
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/runtime/ArrayPrototype.cpp M LayoutTests/ChangeLog A LayoutTests/fast/js/array-enumerators-functions-expected.txt A LayoutTests/fast/js/array-enumerators-functions.html A LayoutTests/fast/js/resources/array-enumerators-functions.js Committed r42567