-
mhahnenberg@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=121717 Reviewed by Oliver Hunt. Source/JavaScriptCore: This bug caused the array to become corrupted. We now check for holes before we start moving things, and start moving things only once we've determined that there are none. * runtime/JSArray.cpp: (JSC::JSArray::shiftCountWithAnyIndexingType): (JSC::JSArray::unshiftCountWithAnyIndexingType): LayoutTests: Added test to make sure that splicing an array with holes works correctly. * js/array-splice-with-holes-expected.txt: Added. * js/array-splice-with-holes.html: Added. * js/script-tests/array-splice-with-holes.js: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156214 268f45cc-cd09-0410-ab3c-d52691b4dbfc
40fcdef2