Changeset 64620 in webkit for trunk/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Aug 3, 2010, 8:05:59 PM (15 years ago)

Author:

[email protected]

Message:

Fix for ​https://bugs.webkit.org/show_bug.cgi?id=43314. The prior code
was using the wrong "length" value to move array contents when adding
space to the beginning of an array for an unshift() or similar
operation. Instead of using m_vectorLength, the length of the
allocated JSValue array, the code was using m_length, the declared
length of the array. These two values do not need to match.

Patch by Michael Saboff <​[email protected]> on 2010-08-03
Reviewed by Gavin Barraclough.

• JavaScriptCore.xcodeproj/project.pbxproj:
• runtime/JSArray.cpp:

(JSC::JSArray::increaseVectorPrefixLength):

File:

• trunk/JavaScriptCore/runtime/JSArray.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -632 +632 @@
 
     memcpy(newStorage, storage, storageSize(0));
-    memcpy(&newStorage->m_vector[newLength - m_vectorLength], &storage->m_vector[0], storage->m_length * sizeof(JSValue));
+    memcpy(&newStorage->m_vector[newLength - m_vectorLength], &storage->m_vector[0], vectorLength * sizeof(JSValue));
     
     newStorage->m_allocBase = newBaseStorage;