Changeset 11519 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Dec 10, 2005, 11:05:22 AM (19 years ago)

Author:

darin

Message:

JavaScriptCore:

Reviewed by Maciej, landed by Darin.

• fix ​http://bugzilla.opendarwin.org/show_bug.cgi?id=3539 Array join and toString methods do not support circular references

• kjs/array_object.cpp: (ArrayProtoFuncImp::callAsFunction): Added set of visited objects -- don't recurse if item is already in the set.

LayoutTests:

New layout test for ​http://bugzilla.opendarwin.org/show_bug.cgi?id=3539

• fast/js/cyclic-ref-toString-expected.txt: Added.
• fast/js/cyclic-ref-toString.html: Added.

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (3 diffs)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -32 +32 @@
 #include "types.h"
 #include "value.h"
+#include "HashSet.h"
 
 #include "array_object.lut.h"
@@ -447 +448 @@
     // fall through
   case Join: {
+    static HashSet< ObjectImp*, PointerHash<ObjectImp*> > visitedElems;
+    if (visitedElems.contains(thisObj))
+      return jsString("");
     UString separator = ",";
     UString str = "";
 
+    visitedElems.insert(thisObj);
     if (!args[0]->isUndefined())
       separator = args[0]->toString(exec);
@@ -489 +494 @@
         break;
     }
+    visitedElems.remove(thisObj);
     result = String(str);
     break;