2010-08-05 Michael Saboff <msaboff@apple.com>

        Reviewed by Darin Adler.

        Fixed https://bugs.webkit.org/show_bug.cgi?id=43401 where array
        content aren't properly initialized as part of unshift.

        * runtime/JSArray.cpp:
        (JSC::JSArray::unshiftCount):
2010-08-05  Michael Saboff  <msaboff@apple.com>

        Reviewed by Darin Adler.

        New regression tests added as part of unshift fix for bug described
        inhttps://bugs.webkit.org/show_bug.cgi?id=43401.

        * fast/js/script-tests/unshift-multi.js: Added.
        * fast/js/unshift-multi-expected.txt: Added.
        * fast/js/unshift-multi.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@64773 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent dddc97ba
2010-08-05 Michael Saboff <msaboff@apple.com>
Reviewed by Darin Adler.
Fixed https://bugs.webkit.org/show_bug.cgi?id=43401 where array
content aren't properly initialized as part of unshift.
* runtime/JSArray.cpp:
(JSC::JSArray::unshiftCount):
2010-08-05 Jian Li <jianli@chromium.org>
Reviewed by David Levin.
......
......@@ -850,10 +850,13 @@ void JSArray::unshiftCount(ExecState* exec, int count)
storage = reinterpret_cast<ArrayStorage*>(newBaseStorage);
setArrayStorage(storage);
m_vectorLength += count;
} else if ((!m_indexBias) && (!increaseVectorPrefixLength(m_vectorLength + count))) {
} else if (!increaseVectorPrefixLength(m_vectorLength + count)) {
throwOutOfMemoryError(exec);
return;
}
for (int i = 0; i < count; i++)
m_vector[i] = JSValue();
}
void JSArray::markChildren(MarkStack& markStack)
......
2010-08-05 Michael Saboff <msaboff@apple.com>
Reviewed by Darin Adler.
New regression tests added as part of unshift fix for bug described
inhttps://bugs.webkit.org/show_bug.cgi?id=43401.
* fast/js/script-tests/unshift-multi.js: Added.
* fast/js/unshift-multi-expected.txt: Added.
* fast/js/unshift-multi.html: Added.
2010-08-05 Martin Robinson <mrobinson@igalia.com>
[GTK] Some sputnik tests fail
description(
'Test for regression against <a href="https://bugs.webkit.org/show_bug.cgi?id=43401">Calling unshift passing more than 1 argument causes array corruption. It also tests some other unshift combinations.'
);
function unshift1(n) {
var anArray = [];
for (var i = 0; i < n; i++) {
anArray.unshift('a');
}
return anArray;
}
function unshift2(n) {
var anArray = [];
for (var i = 0; i < n; i++) {
anArray.unshift('a', 'b');
}
return anArray;
}
function unshift5(n) {
var anArray = [];
for (var i = 0; i < n; i++) {
anArray.unshift('a', 'b', 'c', 'd', 'e');
}
return anArray;
}
shouldBe('unshift1(1)', '["a"]');
shouldBe('unshift1(2)', '["a", "a"]');
shouldBe('unshift1(4)', '["a", "a", "a", "a"]');
shouldBe('unshift2(1)', '["a", "b"]');
shouldBe('unshift2(2)', '["a", "b", "a", "b"]');
shouldBe('unshift2(4)', '["a", "b", "a", "b", "a", "b", "a", "b"]');
shouldBe('unshift2(10)', '["a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b"]');
shouldBe('unshift5(1)', '["a", "b", "c", "d", "e"]');
shouldBe('unshift5(2)', '["a", "b", "c", "d", "e", "a", "b", "c", "d", "e"]');
shouldBe('unshift5(6)', '["a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e"]');
var successfullyParsed = true;
Test for regression against Calling unshift passing more than 1 argument causes array corruption. It also tests some other unshift combinations.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS unshift1(1) is ["a"]
PASS unshift1(2) is ["a", "a"]
PASS unshift1(4) is ["a", "a", "a", "a"]
PASS unshift2(1) is ["a", "b"]
PASS unshift2(2) is ["a", "b", "a", "b"]
PASS unshift2(4) is ["a", "b", "a", "b", "a", "b", "a", "b"]
PASS unshift2(10) is ["a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b", "a", "b"]
PASS unshift5(1) is ["a", "b", "c", "d", "e"]
PASS unshift5(2) is ["a", "b", "c", "d", "e", "a", "b", "c", "d", "e"]
PASS unshift5(6) is ["a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e", "a", "b", "c", "d", "e"]
PASS successfullyParsed is true
TEST COMPLETE
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<link rel="stylesheet" href="resources/js-test-style.css">
<script src="resources/js-test-pre.js"></script>
</head>
<body>
<p id="description"></p>
<div id="console"></div>
<script src="script-tests/unshift-multi.js"></script>
<script src="resources/js-test-post.js"></script>
</body>
</html>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment