Changeset 34809 in webkit for trunk/JavaScriptCore/wtf/AVLTree.h

Timestamp:

Jun 26, 2008, 11:37:44 AM (17 years ago)

Author:

[email protected]

Message:

Reviewed by Darin.

​https://bugs.webkit.org/show_bug.cgi?id=19767
REGRESSION: Crash in sort() when visiting ​http://www.onnyturf.com/subway/

• kjs/JSArray.cpp: (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor): Made changing balance factor from -1 to +1 work correctly.

• wtf/AVLTree.h: (KJS::AVLTreeDefaultBSet::operator[]): Added an assertion that catches this slightly earlier.

File:

• trunk/JavaScriptCore/wtf/AVLTree.h (modified) (2 diffs)

trunk/JavaScriptCore/wtf/AVLTree.h

@@ -33 +33 @@
 #define KJS_AVL_TREE_H_
 
+#include "Assertions.h"
+
 namespace KJS {
 
@@ -64 +66 @@
 class AVLTreeDefaultBSet {
 public:
-    bool& operator[](unsigned i) { return m_data[i]; }
+    bool& operator[](unsigned i) { ASSERT(i < maxDepth); return m_data[i]; }
     void set() { for (unsigned i = 0; i < maxDepth; ++i) m_data[i] = true; }
     void reset() { for (unsigned i = 0; i < maxDepth; ++i) m_data[i] = false; }