diff options
| author | Simon Hausmann <simon.hausmann@digia.com> | 2012-09-26 10:42:44 +0200 |
|---|---|---|
| committer | Simon Hausmann <simon.hausmann@digia.com> | 2012-09-26 10:42:44 +0200 |
| commit | 33b26980cb24288b5a9f2590ccf32a949281bb79 (patch) | |
| tree | cc0203dac37338b24b0b25a4694c0b76d4e4164b /Source/JavaScriptCore/runtime/JSObject.cpp | |
| parent | 715be629d51174233403237bfc563cf150087dc8 (diff) | |
| download | qtwebkit-33b26980cb24288b5a9f2590ccf32a949281bb79.tar.gz | |
Imported WebKit commit c596dd7f03007fa7ed896b928106497e8784b3b5 (http://svn.webkit.org/repository/webkit/trunk@129610)
New snapshot that removes QtQuick1 support (to be moved into QtQuick1 module)
Diffstat (limited to 'Source/JavaScriptCore/runtime/JSObject.cpp')
| -rw-r--r-- | Source/JavaScriptCore/runtime/JSObject.cpp | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp index 7bf12b67e..bf38f6876 100644 --- a/Source/JavaScriptCore/runtime/JSObject.cpp +++ b/Source/JavaScriptCore/runtime/JSObject.cpp @@ -1350,10 +1350,13 @@ void JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue } case NonArrayWithSlowPutArrayStorage: - case ArrayWithSlowPutArrayStorage: - if (attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow)) + case ArrayWithSlowPutArrayStorage: { + // No own property present in the vector, but there might be in the sparse map! + SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get(); + if (!(map && map->contains(i)) && attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow)) return; // Otherwise, fall though. + } case NonArrayWithArrayStorage: case ArrayWithArrayStorage: |