Merge remote-tracking branch 'origin/5.5' into dev

Change-Id: I0cf3a38a8cccbfdeb7942b712d3d878441601c87

2 files changed, 8 insertions, 3 deletions

diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 5637e2090..bd5591986 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -1909,6 +1909,11 @@ void JSObject::putByIndexBeyondVectorLengthWithoutAttributes(ExecState* exec, un
     }
 }
 
+// Used in JSArray.cpp so we must instantiate explicit
+template void JSObject::putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(ExecState* exec, unsigned i, JSValue value);
+template void JSObject::putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(ExecState* exec, unsigned i, JSValue value);
+template void JSObject::putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(ExecState* exec, unsigned i, JSValue value);
+
 void JSObject::putByIndexBeyondVectorLengthWithArrayStorage(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, ArrayStorage* storage)
 {
     VM& vm = exec->vm();
diff --git a/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp b/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
index 14b42fd9a..0b93b6ce1 100644
--- a/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -183,9 +183,9 @@ bool sameValue(ExecState* exec, JSValue a, JSValue b)
 
 bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
 {
-    if (!other.m_value == m_value ||
-        !other.m_getter == m_getter ||
-        !other.m_setter == m_setter)
+    if (other.m_value.isEmpty() != m_value.isEmpty() ||
+        other.m_getter.isEmpty() != m_getter.isEmpty() ||
+        other.m_setter.isEmpty() != m_setter.isEmpty())
         return false;
     return (!m_value || sameValue(exec, other.m_value, m_value))
         && (!m_getter || JSValue::strictEqual(exec, other.m_getter, m_getter))