diff options
| author | Martin Jones <martin.jones@nokia.com> | 2010-08-02 02:56:07 (GMT) |
|---|---|---|
| committer | Martin Jones <martin.jones@nokia.com> | 2010-08-02 02:56:07 (GMT) |
| commit | 666a475ea8c32eb5c49a53b29defc2c66c9cc5e3 (patch) | |
| tree | dfb4fe2d4308f02bf3b8d45331b5d93c1cabae01 /src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp | |
| parent | d39d01497640c3a0818d25036894495f8b597bdb (diff) | |
| parent | e93d11c733bb44208089a7488c6e7a176468d407 (diff) | |
| download | Qt-666a475ea8c32eb5c49a53b29defc2c66c9cc5e3.zip Qt-666a475ea8c32eb5c49a53b29defc2c66c9cc5e3.tar.gz Qt-666a475ea8c32eb5c49a53b29defc2c66c9cc5e3.tar.bz2 | |
Merge branch '4.7' of scm.dev.nokia.troll.no:qt/qt-qml into 4.7
Diffstat (limited to 'src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp')
| -rw-r--r-- | src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp index d3ef44c..ae9e038 100644 --- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp @@ -948,10 +948,10 @@ void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args) void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize) { - ASSERT(m_storage->m_length == maxSize); + ASSERT(m_storage->m_length >= maxSize); UNUSED_PARAM(maxSize); JSValue* vector = m_storage->m_vector; - unsigned vectorEnd = min(m_storage->m_length, m_vectorLength); + unsigned vectorEnd = min(maxSize, m_vectorLength); unsigned i = 0; for (; i < vectorEnd; ++i) { JSValue& v = vector[i]; @@ -960,7 +960,7 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz buffer[i] = v; } - for (; i < m_storage->m_length; ++i) + for (; i < maxSize; ++i) buffer[i] = get(exec, i); } |