Changeset 128667 in webkit for trunk/Source/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Sep 14, 2012, 4:13:07 PM (13 years ago)

Author:

[email protected]

Message:

bbc homepage crashes immediately
​https://bugs.webkit.org/show_bug.cgi?id=96812
<rdar://problem/12081386>

Reviewed by Oliver Hunt.

If you use the old storage pointer to write to space you thought was newly allocated,
you're going to have a bad time.

• runtime/JSArray.cpp:

(JSC::JSArray::unshiftCount):

File:

• trunk/Source/JavaScriptCore/runtime/JSArray.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -550 +550 @@
         storage->m_indexBias -= count;
         storage->setVectorLength(storage->vectorLength() + count);
-    } else if (!unshiftCountSlowCase(exec->globalData(), count)) {
+    } else if (unshiftCountSlowCase(exec->globalData(), count))
+        storage = arrayStorage();
+    else {
         throwOutOfMemoryError(exec);
         return true;