Assert that Array elements not copied when changing shape to ArrayStorage type are...
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 22 Dec 2014 23:09:22 +0000 (23:09 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 22 Dec 2014 23:09:22 +0000 (23:09 +0000)
commit15e94b106cc77006f4999733a04ab62b57329997
tree35dedebdf2d4df0f0abfe70da30e9c0957af5312
parent2f0b03ebad2c57a153c092cadcb16b2dea57c211
Assert that Array elements not copied when changing shape to ArrayStorage type are indeed holes.
<https://webkit.org/b/138118>

Reviewed by Michael Saboff.

* runtime/JSObject.cpp:
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@177657 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSObject.cpp