Changeset 55679 in webkit for trunk/JavaScriptCore/runtime/JSString.cpp

Timestamp:

Mar 8, 2010, 12:31:02 PM (15 years ago)

Author:

[email protected]

Message:

Reverting 55035, this caused a regression.
(​https://bugs.webkit.org/show_bug.cgi?id=35843)

Reviewed by NOBODY (reverting regression).

• runtime/JSString.cpp:

(JSC::JSString::resolveRope):
(JSC::JSString::getStringPropertyDescriptor):

• runtime/JSString.h:

(JSC::jsSingleCharacterSubstring):
(JSC::JSString::getIndex):
(JSC::JSString::getStringPropertySlot):

• runtime/UStringImpl.cpp:
• runtime/UStringImpl.h:

File:

• trunk/JavaScriptCore/runtime/JSString.cpp (modified) (2 diffs)

trunk/JavaScriptCore/runtime/JSString.cpp

@@ -51 +51 @@
         m_value = newImpl;
     else {
+        for (unsigned i = 0; i < m_fiberCount; ++i) {
+            m_other.m_fibers[i]->deref();
+            m_other.m_fibers[i] = 0;
+        }
+        m_fiberCount = 0;
+        ASSERT(!isRope());
+        ASSERT(m_value == UString());
         throwOutOfMemoryError(exec);
         return;
@@ -181 +188 @@
     unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
     if (isStrictUInt32 && i < m_length) {
-        descriptor.setDescriptor(getIndex(exec, i), DontDelete | ReadOnly);
+        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, value(exec), i), DontDelete | ReadOnly);
         return true;
     }