[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[darin at apple.com]

The following commit has been merged in the debian/experimental branch:
commit 099bc16b4b81a3a99d266a6461ee827f6afb5fc2
Author: darin at apple.com <darin at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Sep 14 21:06:01 2010 +0000

    2010-09-14  Darin Adler  <darin at apple.com>
    
            Reviewed by Geoffrey Garen.
    
            Sort with non-numeric custom sort function fails on array with length but no values
            https://bugs.webkit.org/show_bug.cgi?id=45781
    
            * runtime/JSArray.cpp:
            (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead
            exit for any array without values, even if it has a non-0 length.
    2010-09-14  Darin Adler  <darin at apple.com>
    
            Reviewed by Geoffrey Garen.
    
            Sort with non-numeric custom sort function fails on array with length but no values
            https://bugs.webkit.org/show_bug.cgi?id=45781
    
            * fast/js/script-tests/sort-large-array.js: Added test cases.
            * fast/js/sort-large-array-expected.txt: Updated.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@67494 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 0e53210..38bf5ef 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,14 @@
+2010-09-14  Darin Adler  <darin at apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Sort with non-numeric custom sort function fails on array with length but no values
+        https://bugs.webkit.org/show_bug.cgi?id=45781
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead
+        exit for any array without values, even if it has a non-0 length.
+
 2010-09-14  Steve Falkenburg  <sfalken at apple.com>
 
         Windows production build fix.
diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index 55aa327..340cb75 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -1060,10 +1060,11 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     if (storage->m_length > static_cast<unsigned>(std::numeric_limits<int>::max()))
         return;
 
-    if (!storage->m_length)
-        return;
-
     unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
+    unsigned nodeCount = usedVectorLength + (storage->m_sparseValueMap ? storage->m_sparseValueMap->size() : 0);
+
+    if (!nodeCount)
+        return;
 
     AVLTree<AVLTreeAbstractorForArrayCompare, 44> tree; // Depth 44 is enough for 2^31 items
     tree.abstractor().m_exec = exec;
@@ -1071,7 +1072,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     tree.abstractor().m_compareCallType = callType;
     tree.abstractor().m_compareCallData = &callData;
     tree.abstractor().m_globalThisValue = exec->globalThisValue();
-    tree.abstractor().m_nodes.resize(usedVectorLength + (storage->m_sparseValueMap ? storage->m_sparseValueMap->size() : 0));
+    tree.abstractor().m_nodes.grow(nodeCount);
 
     if (callType == CallTypeJS)
         tree.abstractor().m_cachedCall = adoptPtr(new CachedCall(exec, asFunction(compareFunction), 2, exec->exceptionSlot()));
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index cd21ddc..ae87476 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-09-14  Darin Adler  <darin at apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Sort with non-numeric custom sort function fails on array with length but no values
+        https://bugs.webkit.org/show_bug.cgi?id=45781
+
+        * fast/js/script-tests/sort-large-array.js: Added test cases.
+        * fast/js/sort-large-array-expected.txt: Updated.
+
 2010-09-14  Ryosuke Niwa  <rniwa at webkit.org>
 
         Reviewed by Tony Chang.
diff --git a/LayoutTests/fast/js/script-tests/sort-large-array.js b/LayoutTests/fast/js/script-tests/sort-large-array.js
index ee25d0b..0b79652 100644
--- a/LayoutTests/fast/js/script-tests/sort-large-array.js
+++ b/LayoutTests/fast/js/script-tests/sort-large-array.js
@@ -3,7 +3,7 @@ description("This tests sorting an array with more than 10,000 values.");
 var test = [];
 for (var i = 0; i < 10010; i++)
     test.push(10009 - i);
-test.sort(function(a,b) {return a - b;});
+test.sort(function(a, b) {return a - b;});
 
 shouldBe("test.length", "10010");
 shouldBe("test[9999]", "9999");
@@ -11,4 +11,12 @@ shouldBe("test[10000]", "10000");
 shouldBe("test.slice(0, 20).join(', ')", "'0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19'");
 shouldBe("test.slice(9990, 10010).join(', ')", "'9990, 9991, 9992, 9993, 9994, 9995, 9996, 9997, 9998, 9999, 10000, 10001, 10002, 10003, 10004, 10005, 10006, 10007, 10008, 10009'");
 
+var testNoValues = [];
+testNoValues.length = 10110;
+testNoValues.sort(function(a, b) {return a < b;});
+
+shouldBe("testNoValues.length", "10110");
+shouldBe("testNoValues[9999]", "undefined");
+shouldBe("testNoValues[10000]", "undefined");
+
 var successfullyParsed = true;
diff --git a/LayoutTests/fast/js/sort-large-array-expected.txt b/LayoutTests/fast/js/sort-large-array-expected.txt
index 2e201f2..c9040bd 100644
--- a/LayoutTests/fast/js/sort-large-array-expected.txt
+++ b/LayoutTests/fast/js/sort-large-array-expected.txt
@@ -8,6 +8,9 @@ PASS test[9999] is 9999
 PASS test[10000] is 10000
 PASS test.slice(0, 20).join(', ') is '0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19'
 PASS test.slice(9990, 10010).join(', ') is '9990, 9991, 9992, 9993, 9994, 9995, 9996, 9997, 9998, 9999, 10000, 10001, 10002, 10003, 10004, 10005, 10006, 10007, 10008, 10009'
+PASS testNoValues.length is 10110
+PASS testNoValues[9999] is undefined
+PASS testNoValues[10000] is undefined
 PASS successfullyParsed is true
 
 TEST COMPLETE

-- 
WebKit Debian packaging