-
darin@apple.com authored
Reviewed by Alexey. - fix https://bugs.webkit.org/show_bug.cgi?id=19442 JavaScript array implementation doesn't maintain m_numValuesInVector when sorting * kjs/array_instance.cpp: (KJS::ArrayInstance::checkConsistency): Added. Empty inline version for when consistency checks are turned off. (KJS::ArrayInstance::ArrayInstance): Check consistency after construction. (KJS::ArrayInstance::~ArrayInstance): Check consistency before destruction. (KJS::ArrayInstance::put): Check consistency before and after. (KJS::ArrayInstance::deleteProperty): Ditto. (KJS::ArrayInstance::setLength): Ditto. (KJS::compareByStringPairForQSort): Use typedef for clarity. (KJS::ArrayInstance::sort): Check consistency before and after. Also broke the loop to set up sorting into two separate passes. Added FIXMEs about various exception safety issues. Added code to set m_numValuesInVector after sorting. (KJS::ArrayInstance::compactForSorting): Ditto. * kjs/array_instance.h: Added a definition of an enum for the types of consistency check and a declaration of the consistency checking function. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@34496 268f45cc-cd09-0410-ab3c-d52691b4dbfc
772b7730