Changeset 67494 in webkit for trunk/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Sep 14, 2010, 2:06:01 PM (15 years ago)

Author:

Darin Adler

Message:

2010-09-14 Darin Adler <Darin Adler>

Reviewed by Geoffrey Garen.

Sort with non-numeric custom sort function fails on array with length but no values
​https://bugs.webkit.org/show_bug.cgi?id=45781

• runtime/JSArray.cpp: (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead exit for any array without values, even if it has a non-0 length.

2010-09-14 Darin Adler <Darin Adler>

Reviewed by Geoffrey Garen.

Sort with non-numeric custom sort function fails on array with length but no values
​https://bugs.webkit.org/show_bug.cgi?id=45781

• fast/js/script-tests/sort-large-array.js: Added test cases.
• fast/js/sort-large-array-expected.txt: Updated.

File:

• trunk/JavaScriptCore/runtime/JSArray.cpp (modified) (2 diffs)

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -1061 +1061 @@
         return;
 
-    if (!storage->m_length)
-        return;
-
     unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
+    unsigned nodeCount = usedVectorLength + (storage->m_sparseValueMap ? storage->m_sparseValueMap->size() : 0);
+
+    if (!nodeCount)
+        return;
 
     AVLTree<AVLTreeAbstractorForArrayCompare, 44> tree; // Depth 44 is enough for 2^31 items
@@ -1072 +1073 @@
     tree.abstractor().m_compareCallData = &callData;
     tree.abstractor().m_globalThisValue = exec->globalThisValue();
-    tree.abstractor().m_nodes.resize(usedVectorLength + (storage->m_sparseValueMap ? storage->m_sparseValueMap->size() : 0));
+    tree.abstractor().m_nodes.grow(nodeCount);
 
     if (callType == CallTypeJS)