From 33b26980cb24288b5a9f2590ccf32a949281bb79 Mon Sep 17 00:00:00 2001 From: Simon Hausmann Date: Wed, 26 Sep 2012 10:42:44 +0200 Subject: Imported WebKit commit c596dd7f03007fa7ed896b928106497e8784b3b5 (http://svn.webkit.org/repository/webkit/trunk@129610) New snapshot that removes QtQuick1 support (to be moved into QtQuick1 module) --- Source/JavaScriptCore/runtime/JSObject.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'Source/JavaScriptCore/runtime/JSObject.cpp') diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp index 7bf12b67e..bf38f6876 100644 --- a/Source/JavaScriptCore/runtime/JSObject.cpp +++ b/Source/JavaScriptCore/runtime/JSObject.cpp @@ -1350,10 +1350,13 @@ void JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue } case NonArrayWithSlowPutArrayStorage: - case ArrayWithSlowPutArrayStorage: - if (attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow)) + case ArrayWithSlowPutArrayStorage: { + // No own property present in the vector, but there might be in the sparse map! + SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get(); + if (!(map && map->contains(i)) && attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow)) return; // Otherwise, fall though. + } case NonArrayWithArrayStorage: case ArrayWithArrayStorage: -- cgit v1.2.3