-
mhahnenberg@apple.com authored
JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage does a check on the length of the ArrayStorage after possible reallocing it https://bugs.webkit.org/show_bug.cgi?id=120278 Reviewed by Geoffrey Garen. Source/JavaScriptCore: * runtime/JSObject.cpp: (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage): LayoutTests: * fast/js/put-direct-index-beyond-vector-length-resize-expected.txt: Added. * fast/js/put-direct-index-beyond-vector-length-resize.html: Added. * fast/js/script-tests/put-direct-index-beyond-vector-length-resize.js: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154633 268f45cc-cd09-0410-ab3c-d52691b4dbfc
200865d6