-
ap@webkit.org authored
https://bugs.webkit.org/show_bug.cgi?id=19767 REGRESSION: Crash in sort() when visiting http://www.onnyturf.com/subway/ * kjs/JSArray.cpp: (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor): Made changing balance factor from -1 to +1 work correctly. * wtf/AVLTree.h: (KJS::AVLTreeDefaultBSet::operator[]): Added an assertion that catches this slightly earlier. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@34809 268f45cc-cd09-0410-ab3c-d52691b4dbfc
66abd69a