[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198
msaboff at apple.com
msaboff at apple.com
Sun Feb 20 22:48:25 UTC 2011
The following commit has been merged in the webkit-1.3 branch:
commit eb23d0e2d35a4ff80955e190d4a71a8c1e8382a4
Author: msaboff at apple.com <msaboff at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Jan 11 20:24:55 2011 +0000
2011-01-11 Michael Saboff <msaboff at apple.com>
Reviewed by Geoffrey Garen.
Missing call to popTempSortVector() for exception case in JSArray::sort.
https://bugs.webkit.org/show_bug.cgi?id=50718
Fix to patch of 50718 that added pushTempSortVector() and
popTempSortVector() to JSArray::sort() to mark elements during sort.
Need to add popTempSortVector() for the return case if toString()
had an exception.
* runtime/JSArray.cpp:
(JSC::JSArray::sort): Added popTempSortVector()
2011-01-11 Michael Saboff <msaboff at apple.com>
Reviewed by Geoffrey Garen.
Missing call to popTempSortVector() for exception case in JSArray::sort.
https://bugs.webkit.org/show_bug.cgi?id=50718
New test to validate balanced calls to pushTempSortVector() and
popTempSortVector().
* fast/js/array-sort-exception-expected.txt: Added.
* fast/js/array-sort-exception.html: Added.
* fast/js/script-tests/array-sort-exception.js: Added.
(do_gc):
(Item):
(toString_throw):
(test):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75531 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 5591a24..8c16213 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,21 @@
+2011-01-11 Michael Saboff <msaboff at apple.com>
+
+ Reviewed by Geoffrey Garen.
+
+ Missing call to popTempSortVector() for exception case in JSArray::sort.
+ https://bugs.webkit.org/show_bug.cgi?id=50718
+
+ New test to validate balanced calls to pushTempSortVector() and
+ popTempSortVector().
+
+ * fast/js/array-sort-exception-expected.txt: Added.
+ * fast/js/array-sort-exception.html: Added.
+ * fast/js/script-tests/array-sort-exception.js: Added.
+ (do_gc):
+ (Item):
+ (toString_throw):
+ (test):
+
2011-01-11 Zhenyao Mo <zmo at google.com>
Unreviewed, test expectations update.
diff --git a/LayoutTests/fast/js/array-sort-exception-expected.txt b/LayoutTests/fast/js/array-sort-exception-expected.txt
new file mode 100644
index 0000000..1698d8e
--- /dev/null
+++ b/LayoutTests/fast/js/array-sort-exception-expected.txt
@@ -0,0 +1,10 @@
+Test of array sort with toString() override that throws exception.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS catchArg is exceptionString
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/array-sort-exception.html b/LayoutTests/fast/js/array-sort-exception.html
new file mode 100644
index 0000000..32e4c5d
--- /dev/null
+++ b/LayoutTests/fast/js/array-sort-exception.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/array-sort-exception.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/script-tests/array-sort-exception.js b/LayoutTests/fast/js/script-tests/array-sort-exception.js
new file mode 100644
index 0000000..4955b9e
--- /dev/null
+++ b/LayoutTests/fast/js/script-tests/array-sort-exception.js
@@ -0,0 +1,57 @@
+description(
+"Test of array sort with toString() override that throws exception."
+);
+
+var size = 200;
+var digits = 3;
+var exceptionString = 'From toString()';
+var catchArg = "";
+
+var a = new Array(size);
+
+function do_gc() {
+ if (window.GCController)
+ return GCController.collect();
+
+ for (var i = 0; i < 1000; i++)
+ new String(i);
+}
+
+function Item(val) {
+ this.value = val;
+}
+
+function toString_throw() {
+ var s = this.value.toString();
+
+ if (this.value >= size/2)
+ throw(exceptionString);
+
+ s = ('0000' + s).slice(-digits);
+
+ return s;
+}
+
+function test() {
+ for (var i = 0; i < a.length; i++) {
+ a[i] = new Item(a.length - i - 1);
+ a[i].toString = toString_throw;
+ }
+
+ try {
+ a.sort();
+ } catch(err) {
+ catchArg = err;
+ shouldBe("catchArg", "exceptionString");
+
+ do_gc();
+
+ return;
+ }
+
+ debug('ERROR: Never got toString() exception');
+}
+
+test();
+
+var successfullyParsed = true;
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 2fa5dfc..3e8da62 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,18 @@
+2011-01-11 Michael Saboff <msaboff at apple.com>
+
+ Reviewed by Geoffrey Garen.
+
+ Missing call to popTempSortVector() for exception case in JSArray::sort.
+ https://bugs.webkit.org/show_bug.cgi?id=50718
+
+ Fix to patch of 50718 that added pushTempSortVector() and
+ popTempSortVector() to JSArray::sort() to mark elements during sort.
+ Need to add popTempSortVector() for the return case if toString()
+ had an exception.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::sort): Added popTempSortVector()
+
2011-01-11 Xan Lopez <xlopez at igalia.com>
Reviewed by Darin Adler.
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 556a16e..556603b 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -952,8 +952,10 @@ void JSArray::sort(ExecState* exec)
for (size_t i = 0; i < lengthNotIncludingUndefined; i++)
values[i].second = values[i].first.toString(exec);
- if (exec->hadException())
+ if (exec->hadException()) {
+ Heap::heap(this)->popTempSortVector(&values);
return;
+ }
// FIXME: Since we sort by string value, a fast algorithm might be to use a radix sort. That would be O(N) rather
// than O(N log N).
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list