Changeset 40561 in webkit for trunk/JavaScriptCore

Timestamp:

Feb 3, 2009, 5:52:34 PM (16 years ago)

Author:

[email protected]

Message:

2009-02-03 David Hyatt <​[email protected]>

Fix a bug in Vector's shrinkCapacity method. It did not properly copy elements into the inline buffer
when shrinking down from a size that was greater than the inline capacity.

Reviewed by Maciej

• wtf/Vector.h: (WTF::VectorBuffer::VectorBuffer): (WTF::VectorBuffer::allocateBuffer):

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wtf/Vector.h (modified) (2 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-02-03  David Hyatt  <[email protected]>
+
+        Fix a bug in Vector's shrinkCapacity method.  It did not properly copy elements into the inline buffer
+        when shrinking down from a size that was greater than the inline capacity.
+
+        Reviewed by Maciej
+
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::VectorBuffer):
+        (WTF::VectorBuffer::allocateBuffer):
+
 2009-02-03  Simon Hausmann  <[email protected]>
 

trunk/JavaScriptCore/wtf/Vector.h

@@ -378 +378 @@
             : Base(inlineBuffer(), inlineCapacity)
         {
-            allocateBuffer(capacity);
+            if (capacity > inlineCapacity)
+                Base::allocateBuffer(capacity);
         }
 
@@ -390 +391 @@
             if (newCapacity > inlineCapacity)
                 Base::allocateBuffer(newCapacity);
+            else {
+                m_buffer = inlineBuffer();
+                m_capacity = inlineCapacity;
+            }
         }