Changeset 36106 in webkit for trunk/JavaScriptCore/kjs/StructureID.cpp

Timestamp:

Sep 4, 2008, 8:11:54 PM (17 years ago)

Author:

[email protected]

Message:

2008-09-04 Gavin Barraclough <​[email protected]>

Reviewed by Geoffrey Garen.

Fixed an off-by-one error that would cause the StructureIDChain to
be one object too short.

Can't construct a test case because other factors make this not crash
(yet!).

• kjs/StructureID.cpp: (KJS::StructureIDChain::StructureIDChain):

File:

• trunk/JavaScriptCore/kjs/StructureID.cpp (modified) (2 diffs)

trunk/JavaScriptCore/kjs/StructureID.cpp

@@ -110 +110 @@
 StructureIDChain::StructureIDChain(StructureID* structureID)
 {
-    size_t size = 0;
+    size_t size = 1;
 
     StructureID* tmp = structureID;
@@ -117 +117 @@
         tmp = static_cast<JSCell*>(tmp->prototype())->structureID();
     }
-
+    
     m_vector.set(new RefPtr<StructureID>[size]);
 
-    for (size_t i = 0; i < size; ++i) {
+    size_t i;
+    for (i = 0; i < size - 1; ++i) {
         m_vector[i] = structureID;
         structureID = static_cast<JSObject*>(structureID->prototype())->structureID();
     }
+    m_vector[i] = structureID;
 }