Commit 66abd69a authored by ap@webkit.org's avatar ap@webkit.org

Reviewed by Darin.

        https://bugs.webkit.org/show_bug.cgi?id=19767
        REGRESSION: Crash in sort() when visiting http://www.onnyturf.com/subway/

        * kjs/JSArray.cpp: (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor):
        Made changing balance factor from -1 to +1 work correctly.

        * wtf/AVLTree.h: (KJS::AVLTreeDefaultBSet::operator[]): Added an assertion that catches
        this slightly earlier.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@34809 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 647f4529
2008-06-26 Alexey Proskuryakov <ap@webkit.org>
Reviewed by Darin.
https://bugs.webkit.org/show_bug.cgi?id=19767
REGRESSION: Crash in sort() when visiting http://www.onnyturf.com/subway/
* kjs/JSArray.cpp: (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor):
Made changing balance factor from -1 to +1 work correctly.
* wtf/AVLTree.h: (KJS::AVLTreeDefaultBSet::operator[]): Added an assertion that catches
this slightly earlier.
2008-06-25 Timothy Hatcher <timothy@apple.com>
Fixes an ASSERT in the profiler when starting multiple profiles
......
......@@ -584,6 +584,8 @@ struct AVLTreeAbstractorForArrayCompare {
m_nodes[h].lt |= 0x80000000;
if (bf < 0)
m_nodes[h].gt |= 0x80000000;
else
m_nodes[h].gt &= 0x7FFFFFFF;
}
}
......
......@@ -32,6 +32,8 @@
#ifndef KJS_AVL_TREE_H_
#define KJS_AVL_TREE_H_
#include "Assertions.h"
namespace KJS {
// Here is the reference class for BSet.
......@@ -63,7 +65,7 @@ namespace KJS {
template<unsigned maxDepth>
class AVLTreeDefaultBSet {
public:
bool& operator[](unsigned i) { return m_data[i]; }
bool& operator[](unsigned i) { ASSERT(i < maxDepth); return m_data[i]; }
void set() { for (unsigned i = 0; i < maxDepth; ++i) m_data[i] = true; }
void reset() { for (unsigned i = 0; i < maxDepth; ++i) m_data[i] = false; }
......
2008-06-26 Alexey Proskuryakov <ap@webkit.org>
Reviewed by Darin.
https://bugs.webkit.org/show_bug.cgi?id=19767
REGRESSION: Crash in sort() when visiting http://www.onnyturf.com/subway/
* fast/js/avl-crash-expected.txt: Added.
* fast/js/avl-crash.html: Added.
* fast/js/resources/avl-crash.js: Added.
2008-06-25 Jean-Charles Verdié <jcverdie@pleyo.com>
Reviewed by Geoffrey Garen.
This test checks for a crash in sort() that was seen on a particular input data set.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS successfullyParsed is true
TEST COMPLETE
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<link rel="stylesheet" href="resources/js-test-style.css">
<script src="resources/js-test-pre.js"></script>
</head>
<body>
<p id="description"></p>
<div id="console"></div>
<script src="resources/avl-crash.js"></script>
<script src="resources/js-test-post.js"></script>
</body>
</html>
description(
"This test checks for a crash in sort() that was seen on a particular input data set."
);
function natcompare(a, b) {
if (a == b)
return 0;
return (a < b) ? -1 : 1;
}
SubwayData = [
"23rd St-Broadway ",
"45 Road-Court Sq",
"LIC-Court Sq",
"LIC-Court Sq",
"23rd St-Park Ave S",
"241st St",
"242nd St",
"25th Ave",
"25th St",
"28th St-7th Ave",
"28th St-Broadway",
"28th St-Park Ave S",
"2nd Ave-Houston St",
"30th Ave",
"33rd St",
"33rd St-Park Ave",
"34th St-6th Ave",
"34th St-7th Ave",
"34th St-8th Ave",
"36th Ave",
"36th St",
"36th St",
"39th Ave",
"3rd Ave-138th St",
"3rd Ave-149th St",
"3rd Ave-14th St",
"40th St",
"42nd St-5th Ave-6th Ave",
"42nd St-5th Ave-6th Ave",
"45th St",
"46th St",
"46th St",
"47-50th Sts-Rockefeller Center",
"49th St-7th Ave",
"50th St-New Utrecht Ave",
"9th Ave",
"90th St-Elmhurst Ave",
"96th St",
"96th St",
"96th St",
"9th St-4th Ave",
"Alabama Ave",
"Allerton Ave",
"Aqueduct-North Conduit Ave",
"Astor Place",
"Astoria Blvd",
"Atlantic Ave",
"Atlantic Ave-Pacific St",
"Ave H",
"Ave N",
"Ave P",
"Ave U",
"Ave U",
"Ave U",
"Ave X",
"Bay Pkwy",
"Bay Pkwy",
"Bay Pkwy-22nd Ave",
"Bay Ridge Ave",
"Baychester Ave",
"Beach 105th St",
"Beach 25th St",
"Beach 36th St",
"Beach 44th St",
"Beach 60th St",
"Beach 67th St",
"Beach 90th St",
"Beach 98th St",
"Bedford Ave",
"Bedford Park Blvd",
"Broadway",
"Broadway",
"Bronx Park East",
"Brook Ave",
"Buhre Ave",
"Burke Ave",
"Burnside Ave",
"Bushwick Ave",
"Uptown Bleecker St-Lafayette St",
"Downtown Bleecker St-Lafayette St",
"Canal Street",
"Canal Street",
"Canal Street",
"Canal-Church Sts"
];
SubwayData.sort(natcompare)
successfullyParsed = true;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment