Changeset 20991 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Apr 21, 2007, 1:09:45 AM (18 years ago)

Author:

bdash

Message:

2007-04-21 Mitz Pettel <​[email protected]>

Reviewed by Adam.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=13428 REGRESSION (r20973-r20976): Failing ecma/Array/15.4.4.5-3.js

• fix ​http://bugs.webkit.org/show_bug.cgi?id=13429 REGRESSION (r20973-r20976): Crashing in fast/dom/plugin-attributes-enumeration.html

• kjs/array_object.cpp: (ArrayInstance::sort): Free the old storage, not the new one.

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (2 diffs)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -318 +318 @@
         memcpy(storageCopy, storage, capacity * sizeof(JSValue*));
         mergesort(storageCopy, lengthNotIncludingUndefined, sizeof(JSValue *), compareByStringForQSort);
+        fastFree(storage);
         storage = storageCopy;
-        fastFree(storage);
         execForCompareByStringForQSort = oldExec;
         return;
@@ -385 +385 @@
         memcpy(storageCopy, storage, capacity * sizeof(JSValue*));
         mergesort(storageCopy, lengthNotIncludingUndefined, sizeof(JSValue *), compareWithCompareFunctionForQSort);
+        fastFree(storage);
         storage = storageCopy;
         compareWithCompareFunctionArguments = oldArgs;