-
darin@apple.com authored
Reviewed by Mitz. - fix http://bugs.webkit.org/show_bug.cgi?id=15848 <rdar://problem/5619330> REGRESSION: Assertion failure viewing comments page on digg.com Test: fast/js/sparse-array.html * kjs/array_instance.cpp: (KJS::ArrayInstance::inlineGetOwnPropertySlot): Check sparse array cutoff before looking in hash map. Can't avoid the branch because we can't look for 0 in the hash. (KJS::ArrayInstance::deleteProperty): Ditto. LayoutTests: Reviewed by Mitz. - test for http://bugs.webkit.org/show_bug.cgi?id=15848 <rdar://problem/5619330> REGRESSION: Assertion failure viewing comments page on digg.com * fast/js/resources/sparse-array.js: Added. * fast/js/sparse-array-expected.txt: Added. * fast/js/sparse-array.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@28346 268f45cc-cd09-0410-ab3c-d52691b4dbfc
7f3c7caf