[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.1.15-1-40151-g37bb677

[darin]

The following commit has been merged in the debian/unstable branch:
commit 4a7a3872cbe2c9203cc006537eb90332126fcaa2
Author: darin <darin at 268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sat Oct 26 05:49:57 2002 +0000

    	- fixed 3038011 -- drop-down menu hierarchy broken at yahoo new acct page
    
            * kjs/array_object.cpp: (ArrayProtoFuncImp::call):
    	Fix bug calling concat on an empty array. The old code tried to
    	optimize in a way that would prevent appending any arrays until
    	at least one element was in the destination array. So if you were
    	concatenating a non-empty array into an empty array, you got an empty array.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@2475 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 102c9a5..5bca3b8 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,13 @@
+2002-10-25  Darin Adler  <darin at apple.com>
+
+	- fixed 3038011 -- drop-down menu hierarchy broken at yahoo new acct page
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call):
+	Fix bug calling concat on an empty array. The old code tried to
+	optimize in a way that would prevent appending any arrays until
+	at least one element was in the destination array. So if you were
+	concatenating a non-empty array into an empty array, you got an empty array.
+
 === Alexander-29 ===
 
 === Alexander-28 ===
diff --git a/JavaScriptCore/ChangeLog-2002-12-03 b/JavaScriptCore/ChangeLog-2002-12-03
index 102c9a5..5bca3b8 100644
--- a/JavaScriptCore/ChangeLog-2002-12-03
+++ b/JavaScriptCore/ChangeLog-2002-12-03
@@ -1,3 +1,13 @@
+2002-10-25  Darin Adler  <darin at apple.com>
+
+	- fixed 3038011 -- drop-down menu hierarchy broken at yahoo new acct page
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call):
+	Fix bug calling concat on an empty array. The old code tried to
+	optimize in a way that would prevent appending any arrays until
+	at least one element was in the destination array. So if you were
+	concatenating a non-empty array into an empty array, you got an empty array.
+
 === Alexander-29 ===
 
 === Alexander-28 ===
diff --git a/JavaScriptCore/ChangeLog-2003-10-25 b/JavaScriptCore/ChangeLog-2003-10-25
index 102c9a5..5bca3b8 100644
--- a/JavaScriptCore/ChangeLog-2003-10-25
+++ b/JavaScriptCore/ChangeLog-2003-10-25
@@ -1,3 +1,13 @@
+2002-10-25  Darin Adler  <darin at apple.com>
+
+	- fixed 3038011 -- drop-down menu hierarchy broken at yahoo new acct page
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call):
+	Fix bug calling concat on an empty array. The old code tried to
+	optimize in a way that would prevent appending any arrays until
+	at least one element was in the destination array. So if you were
+	concatenating a non-empty array into an empty array, you got an empty array.
+
 === Alexander-29 ===
 
 === Alexander-28 ===
diff --git a/JavaScriptCore/kjs/array_object.cpp b/JavaScriptCore/kjs/array_object.cpp
index 5adbe28..52123ff 100644
--- a/JavaScriptCore/kjs/array_object.cpp
+++ b/JavaScriptCore/kjs/array_object.cpp
@@ -290,8 +290,9 @@ Value ArrayProtoFuncImp::call(ExecState *exec, Object &thisObj, const List &args
       if (curArg.type() == ObjectType &&
           curObj.inherits(&ArrayInstanceImp::info)) {
         unsigned int k = 0;
-        if (n > 0)
-          length = curObj.get(exec,lengthPropertyName).toUInt32(exec);
+        // Older versions tried to optimize out getting the length of thisObj
+        // by checking for n != 0, but that doesn't work if thisObj is an empty array.
+        length = curObj.get(exec,lengthPropertyName).toUInt32(exec);
         while (k < length) {
           if (curObj.hasProperty(exec,k))
             arr.put(exec, n, curObj.get(exec, k));

-- 
WebKit Debian packaging