diff options
| author | Simon Hausmann <simon.hausmann@digia.com> | 2012-09-26 10:42:44 +0200 |
|---|---|---|
| committer | Simon Hausmann <simon.hausmann@digia.com> | 2012-09-26 10:42:44 +0200 |
| commit | 33b26980cb24288b5a9f2590ccf32a949281bb79 (patch) | |
| tree | cc0203dac37338b24b0b25a4694c0b76d4e4164b /Source/JavaScriptCore/runtime/JSArray.cpp | |
| parent | 715be629d51174233403237bfc563cf150087dc8 (diff) | |
| download | qtwebkit-33b26980cb24288b5a9f2590ccf32a949281bb79.tar.gz | |
Imported WebKit commit c596dd7f03007fa7ed896b928106497e8784b3b5 (http://svn.webkit.org/repository/webkit/trunk@129610)
New snapshot that removes QtQuick1 support (to be moved into QtQuick1 module)
Diffstat (limited to 'Source/JavaScriptCore/runtime/JSArray.cpp')
| -rw-r--r-- | Source/JavaScriptCore/runtime/JSArray.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp index 609781c65..8398ae77d 100644 --- a/Source/JavaScriptCore/runtime/JSArray.cpp +++ b/Source/JavaScriptCore/runtime/JSArray.cpp @@ -499,6 +499,7 @@ bool JSArray::shiftCount(ExecState* exec, unsigned count) ArrayStorage* storage = ensureArrayStorage(exec->globalData()); unsigned oldLength = storage->length(); + ASSERT(count <= oldLength); // If the array contains holes or is otherwise in an abnormal state, // use the generic algorithm in ArrayPrototype. |