haikuwebkit/LayoutTests/js/array-splice-with-holes.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/array-splice-with-holes.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
(un)shiftCountWithAnyIndexingType will start over in the middle of copying if it sees a hole https://bugs.webkit.org/show_bug.cgi?id=121717 Reviewed by Oliver Hunt. Source/JavaScriptCore: This bug caused the array to become corrupted. We now check for holes before we start moving things, and start moving things only once we've determined that there are none. * runtime/JSArray.cpp: (JSC::JSArray::shiftCountWithAnyIndexingType): (JSC::JSArray::unshiftCountWithAnyIndexingType): LayoutTests: Added test to make sure that splicing an array with holes works correctly. * js/array-splice-with-holes-expected.txt: Added. * js/array-splice-with-holes.html: Added. * js/script-tests/array-splice-with-holes.js: Added. Canonical link: https://commits.webkit.org/139726@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@156214 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2013-09-21 00:24:08 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/array-splice-with-holes.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`