Changeset 34809 in webkit for trunk/JavaScriptCore/kjs/JSArray.cpp

Timestamp:

Jun 26, 2008, 11:37:44 AM (17 years ago)

Author:

[email protected]

Message:

Reviewed by Darin.

​https://bugs.webkit.org/show_bug.cgi?id=19767
REGRESSION: Crash in sort() when visiting ​http://www.onnyturf.com/subway/

• kjs/JSArray.cpp: (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor): Made changing balance factor from -1 to +1 work correctly.

• wtf/AVLTree.h: (KJS::AVLTreeDefaultBSet::operator[]): Added an assertion that catches this slightly earlier.

File:

• trunk/JavaScriptCore/kjs/JSArray.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/JSArray.cpp

@@ -585 +585 @@
             if (bf < 0)
                 m_nodes[h].gt |= 0x80000000;
+            else
+                m_nodes[h].gt &= 0x7FFFFFFF;
         }
     }