Changeset 41028 in webkit for trunk/JavaScriptCore/runtime/Arguments.cpp

Timestamp:

Feb 16, 2009, 4:40:39 PM (16 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2009-02-16 Sam Weinig <​[email protected]>

Reviewed by Geoffrey Garen.

Fix for <rdar://problem/6468156>
REGRESSION (r36779): Adding link, images, flash in TinyMCE blocks entire page (21382)

No performance regression.

• runtime/Arguments.cpp: (JSC::Arguments::fillArgList): Add codepath for when the "length" property has been overridden.

LayoutTests:

2009-02-16 Sam Weinig <​[email protected]>

Reviewed by Geoffrey Garen.

Add tests for <rdar://problem/6468156>
REGRESSION (r36779): Adding link, images, flash in TinyMCE blocks entire page (21382)

• fast/js/function-apply-expected.txt:
• fast/js/resources/function-apply.js: Add cases covering setting arugments.length and Array.length explicitly or implicitly using Array.prototype.unshift.

File:

• trunk/JavaScriptCore/runtime/Arguments.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/Arguments.cpp

@@ -72 +72 @@
 void Arguments::fillArgList(ExecState* exec, ArgList& args)
 {
+    if (UNLIKELY(d->overrodeLength)) {
+        unsigned length = get(exec, exec->propertyNames().length).toUInt32(exec); 
+        for (unsigned i = 0; i < length; i++) 
+            args.append(get(exec, i)); 
+        return;
+   }
+
     if (LIKELY(!d->deletedArguments)) {
         if (LIKELY(!d->numParameters)) {