Changeset 231339 in webkit for trunk/Source/JavaScriptCore/jsc.cpp

Timestamp:

May 3, 2018, 5:49:04 PM (7 years ago)

Author:

[email protected]

Message:

Invoke ensureArrayStorage for all arguments
​https://bugs.webkit.org/show_bug.cgi?id=185247

Patch by Dominik Infuehr <​[email protected]> on 2018-05-03
Reviewed by Yusuke Suzuki.

ensureArrayStorage was only invoked for first argument in each loop iteration.

• jsc.cpp:

(functionEnsureArrayStorage):

File:

• trunk/Source/JavaScriptCore/jsc.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/jsc.cpp

@@ -2038 +2038 @@
     VM& vm = exec->vm();
     for (unsigned i = 0; i < exec->argumentCount(); ++i) {
-        if (JSObject* object = jsDynamicCast<JSObject*>(vm, exec->argument(0)))
+        if (JSObject* object = jsDynamicCast<JSObject*>(vm, exec->argument(i)))
             object->ensureArrayStorage(vm);
     }