Reviewed by Darin Adler.

        - fix http://bugs.webkit.org/show_bug.cgi?id=17511
          REGRESSION: Reproducible crash in SegmentedSubstring::SegmentedSubstring(SegmentedSubstring const&)

        * wtf/Deque.h:
        (WTF::::expandCapacityIfNeeded): Fixed the case where m_start and m_end
        are both zero but the buffer capacity is non-zero.
        (WTF::::prepend): Added validity checks.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@30550 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index f45a86480e1f75009f384c928fea3c27fb57135e..f1c794e9ed5aa50bed97854eabc74ab75cae7d34 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,15 @@
+2008-02-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17511
+          REGRESSION: Reproducible crash in SegmentedSubstring::SegmentedSubstring(SegmentedSubstring const&)
+
+        * wtf/Deque.h:
+        (WTF::::expandCapacityIfNeeded): Fixed the case where m_start and m_end
+        are both zero but the buffer capacity is non-zero.
+        (WTF::::prepend): Added validity checks.
+
 2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
 
         Rubber stamped by Darin.

diff --git a/JavaScriptCore/wtf/Deque.h b/JavaScriptCore/wtf/Deque.h
index 01bf40c64b3813c66237594a164f5d66e3054d7d..f8cf4fedbbc0e1ff85b59190f6b264640905a062 100644 (file)
--- a/JavaScriptCore/wtf/Deque.h
+++ b/JavaScriptCore/wtf/Deque.h
@@ -369,10 +369,12 @@ namespace WTF {
         if (m_start) {
             if (m_end + 1 != m_start)
                 return;
-        } else {
-            if (m_end && m_end != m_buffer.capacity() - 1)
+        } else if (m_end) {
+            if (m_end != m_buffer.capacity() - 1)
                 return;
-        }
+        } else if (m_buffer.capacity())
+            return;
+
         expandCapacity();
     }
 
@@ -412,12 +414,14 @@ namespace WTF {
     template<typename T> template<typename U>
     inline void Deque<T>::prepend(const U& value)
     {
+        checkValidity();
         expandCapacityIfNeeded();
         if (!m_start)
             m_start = m_buffer.capacity() - 1;
         else
             --m_start;
         new (&m_buffer.buffer()[m_start]) T(value);
+        checkValidity();
     }
 
     template<typename T>