JSArray::shiftCountWithArrayStorage doesn't change indexBias when shifting the...
JSArray::shiftCountWithArrayStorage doesn't change indexBias when shifting the last element in m_vector https://bugs.webkit.org/show_bug.cgi?id=120389 Reviewed by Michael Saboff. Went through and cleaned up shiftCountWithArrayStorage. Gave meaningful variable names and commented the confusing parts. This led to realizing how to fix this bug, which has been done. The issue was that we were modifying the vector length unconditionally, even when we weren't logically changing the length of the vector. Instead, we should only modify the vector length when we modify the index bias. * runtime/JSArray.cpp: (JSC::JSArray::shiftCountWithArrayStorage): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155395 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Showing with 59 additions and 20 deletions