Changeset 67494 in webkit for trunk/JavaScriptCore

Timestamp:

Sep 14, 2010, 2:06:01 PM (15 years ago)

Author:

Darin Adler

Message:

2010-09-14 Darin Adler <Darin Adler>

Reviewed by Geoffrey Garen.

Sort with non-numeric custom sort function fails on array with length but no values
​https://bugs.webkit.org/show_bug.cgi?id=45781

• runtime/JSArray.cpp: (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead exit for any array without values, even if it has a non-0 length.

2010-09-14 Darin Adler <Darin Adler>

Reviewed by Geoffrey Garen.

Sort with non-numeric custom sort function fails on array with length but no values
​https://bugs.webkit.org/show_bug.cgi?id=45781

• fast/js/script-tests/sort-large-array.js: Added test cases.
• fast/js/sort-large-array-expected.txt: Updated.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSArray.cpp (modified) (2 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2010-09-14  Darin Adler  <[email protected]>
+
+        Reviewed by Geoffrey Garen.
+
+        Sort with non-numeric custom sort function fails on array with length but no values
+        https://bugs.webkit.org/show_bug.cgi?id=45781
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead
+        exit for any array without values, even if it has a non-0 length.
+
 2010-09-14  Steve Falkenburg  <[email protected]>
 

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -1061 +1061 @@
         return;
 
-    if (!storage->m_length)
-        return;
-
     unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
+    unsigned nodeCount = usedVectorLength + (storage->m_sparseValueMap ? storage->m_sparseValueMap->size() : 0);
+
+    if (!nodeCount)
+        return;
 
     AVLTree<AVLTreeAbstractorForArrayCompare, 44> tree; // Depth 44 is enough for 2^31 items
@@ -1072 +1073 @@
     tree.abstractor().m_compareCallData = &callData;
     tree.abstractor().m_globalThisValue = exec->globalThisValue();
-    tree.abstractor().m_nodes.resize(usedVectorLength + (storage->m_sparseValueMap ? storage->m_sparseValueMap->size() : 0));
+    tree.abstractor().m_nodes.grow(nodeCount);
 
     if (callType == CallTypeJS)