Changeset 128667 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Sep 14, 2012, 4:13:07 PM (13 years ago)

Author:

[email protected]

Message:

bbc homepage crashes immediately
​https://bugs.webkit.org/show_bug.cgi?id=96812
<rdar://problem/12081386>

Reviewed by Oliver Hunt.

If you use the old storage pointer to write to space you thought was newly allocated,
you're going to have a bad time.

• runtime/JSArray.cpp:

(JSC::JSArray::unshiftCount):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-09-14  Filip Pizlo  <[email protected]>
+
+        bbc homepage crashes immediately
+        https://bugs.webkit.org/show_bug.cgi?id=96812
+        <rdar://problem/12081386>
+
+        Reviewed by Oliver Hunt.
+
+        If you use the old storage pointer to write to space you thought was newly allocated,
+        you're going to have a bad time.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCount):
+
 2012-09-14  Adam Barth  <[email protected]>