JavaScriptCore:
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 3 Dec 2007 15:46:14 +0000 (15:46 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 3 Dec 2007 15:46:14 +0000 (15:46 +0000)
commit8d30f527352ffbf9188fd7701df3cc6b7ce9f0af
tree0d622c3f59006b867cc92521d2b8ef1083e53fc0
parentcba7c130cc5e4f1dd47c39b986cf0ca7b9848c94
JavaScriptCore:

        Reviewed by Mitz.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15848
          <rdar://problem/5619330> REGRESSION: Assertion failure viewing comments page on digg.com

        Test: fast/js/sparse-array.html

        * kjs/array_instance.cpp:
        (KJS::ArrayInstance::inlineGetOwnPropertySlot): Check sparse array cutoff before looking
        in hash map. Can't avoid the branch because we can't look for 0 in the hash.
        (KJS::ArrayInstance::deleteProperty): Ditto.

LayoutTests:

        Reviewed by Mitz.

        - test for http://bugs.webkit.org/show_bug.cgi?id=15848
          <rdar://problem/5619330> REGRESSION: Assertion failure viewing comments page on digg.com

        * fast/js/resources/sparse-array.js: Added.
        * fast/js/sparse-array-expected.txt: Added.
        * fast/js/sparse-array.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28346 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore/ChangeLog
JavaScriptCore/kjs/array_instance.cpp
LayoutTests/ChangeLog
LayoutTests/fast/js/resources/sparse-array.js [new file with mode: 0644]
LayoutTests/fast/js/sparse-array-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/sparse-array.html [new file with mode: 0644]