JavaScriptCore:

        Reviewed by Chris.

	<rdar://problem/4092136> reproducible crash in KJS::kjs_fast_realloc loading maps.google.com

	* kjs/string_object.cpp:
        (StringObjectFuncImp::call): Allocate adopted ustring buffer properly.

WebCore:

        New test case for <rdar://problem/4092136> reproducible crash in KJS::kjs_fast_realloc loading maps.google.com

        * layout-tests/fast/js/string-from-char-code-expected.txt: Added.
        * layout-tests/fast/js/string-from-char-code.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@9059 268f45cc-cd09-0410-ab3c-d52691b4dbfc
5 files changed
tree: ed48879a11a546f6f75418aabc5c08997b283358
  1. JavaScriptCore/
  2. LayoutTests/
  3. WebCore/
  4. WebKit/