Changeset 110352 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Mar 9, 2012, 5:20:01 PM (13 years ago)

Author:

[email protected]

Message:

Array.prototype.toLocaleString visits elements in wrong order under certain conditions
​https://bugs.webkit.org/show_bug.cgi?id=80663

Reviewed by Michael Saboff.

The bug here is actually that we're continuing to process the array after an exception
has been thrown, and that the second value throw is overriding the first.

Source/JavaScriptCore:

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncToLocaleString):

LayoutTests:

• fast/js/array-prototype-properties-expected.txt:
• fast/js/script-tests/array-prototype-properties.js:

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-03-09  Gavin Barraclough  <[email protected]>
+
+        Array.prototype.toLocaleString visits elements in wrong order under certain conditions
+        https://bugs.webkit.org/show_bug.cgi?id=80663
+
+        Reviewed by Michael Saboff.
+
+        The bug here is actually that we're continuing to process the array after an exception
+        has been thrown, and that the second value throw is overriding the first.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+
 2012-03-09  Ryosuke Niwa  <[email protected]>