Changeset 27678 in webkit for trunk/JavaScriptCore/kjs/property_map.cpp

Timestamp:

Nov 10, 2007, 5:07:00 PM (18 years ago)

Author:

Darin Adler

Message:

JavaScriptCore:

Reviewed by Sam.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=15927 REGRESSION(r27487): delete a.c followed by defineGetter("c", ...) incorrectly deletes another property and <rdar://problem/5586384> REGRESSION (r27487): Can't switch out of Edit HTML Source mode on Leopard Wiki

Test: fast/js/delete-then-put.html

• kjs/property_map.cpp: (KJS::PropertyMap::put): Added a missing "- 1"; code to find an empty slot was not working. (KJS::PropertyMap::checkConsistency): Added a missing range check that would have caught this problem before.

• roll out a last-minute change to my evaluateToBoolean patch that was incorrect.

• kjs/nodes.h: (KJS::ExprStatementNode::ExprStatementNode): Take out call to optimizeForUnnecessaryResult, since the result is used in some cases.

LayoutTests:

Reviewed by Sam.

• test for ​http://bugs.webkit.org/show_bug.cgi?id=15927 delete a.c followed by defineGetter("c", ...) incorrectly deletes another property

• fast/js/delete-then-put-expected.txt: Added.
• fast/js/delete-then-put.html: Added.
• fast/js/resources/delete-then-put.js: Added.

File:

• trunk/JavaScriptCore/kjs/property_map.cpp (modified) (3 diffs)

trunk/JavaScriptCore/kjs/property_map.cpp

@@ -427 +427 @@
         // slot that we can use. We know it will be there because we did at least one
         // deletion in the past that left an entry empty.
-        while (m_u.table->entries()[--entryIndex].key)
+        while (m_u.table->entries()[--entryIndex - 1].key)
             ;
     }
@@ -820 +820 @@
             continue;
         }
+        ASSERT(entryIndex > deletedSentinelIndex);
+        ASSERT(entryIndex - 1 <= m_u.table->keyCount + m_u.table->deletedSentinelCount);
         ++indexCount;
 
         for (unsigned b = a + 1; b != m_u.table->size; ++b)
             ASSERT(m_u.table->entryIndicies[b] != entryIndex);
-
     }
     ASSERT(indexCount == m_u.table->keyCount);
@@ -831 +832 @@
     ASSERT(m_u.table->entries()[0].key == 0);
 
-    unsigned entryCount = m_u.table->keyCount + m_u.table->deletedSentinelCount;
     unsigned nonEmptyEntryCount = 0;
-    for (unsigned c = 1; c <= entryCount; ++c) {
+    for (unsigned c = 1; c <= m_u.table->keyCount + m_u.table->deletedSentinelCount; ++c) {
         UString::Rep* rep = m_u.table->entries()[c].key;
         if (!rep) {