Bug 217634

Summary:

Array.prototype.sort's sortBucketSort accesses an array in an invalid way that can lead to incorrect results with indexed properties on the prototype chain

Product:

WebKit

Reporter:

Saam Barati <saam>

Component:

JavaScriptCore

Assignee:

Saam Barati <saam>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, cffsmith, ews-watchlist, fpizlo, ggaren, gskachkov, guijemont, joepeck, jsc32, keith_miller, mark.lam, msaboff, rmorisset, ross.kirsling, ticaiolima, tzagallo, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

Other

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
patch	none

Description Saam Barati 2020-10-12 14:28:21 PDT

...

Comment 1 Saam Barati 2020-10-12 14:28:53 PDT

<rdar://problem/69489404>

Comment 2 Saam Barati 2020-10-12 14:53:50 PDT

Created attachment 411162 [details]
patch

Comment 3 Yusuke Suzuki 2020-10-12 14:56:37 PDT

Comment on attachment 411162 [details]
patch

r=me

Comment 4 Saam Barati 2020-10-12 16:13:51 PDT

*** Bug 217516 has been marked as a duplicate of this bug. ***

Comment 5 EWS 2020-10-12 16:21:29 PDT

Committed r268375: <https://trac.webkit.org/changeset/268375>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 411162 [details].