Fix a bug in Array::push_back

We would in some cases write the value to the wrong place.
This fixes the type error in the DeltaBlue V8 benchmark.

Change-Id: Ic64570248d83890d5e66d718b9087c2bf966690a
Reviewed-by: Erik Verbruggen <erik.verbruggen@digia.com>

diff --git a/src/v4/qv4array.h b/src/v4/qv4array.h
index 13d2e0c..9fb8bb6 100644 (file)
--- a/src/v4/qv4array.h
+++ b/src/v4/qv4array.h
@@ -553,10 +553,9 @@ public:
             if (!offset)
                 getHeadRoom();
 
-            PropertyDescriptor pd;
-            fillDescriptor(&pd, v);
             --offset;
-            values[offset] = pd;
+            PropertyDescriptor &pd = values[offset];
+            fillDescriptor(&pd, v);
         } else {
             uint idx = allocValue(v);
             sparse->push_front(idx);
@@ -590,9 +589,10 @@ public:
     }
     void push_back(Value v) {
         if (!sparse) {
-            PropertyDescriptor pd;
+            if (len + offset >= (uint)values.size())
+                values.resize(values.size() + 1);
+            PropertyDescriptor &pd = values[len + offset];
             fillDescriptor(&pd, v);
-            values.append(pd);
         } else {
             uint idx = allocValue(v);
             sparse->push_back(idx, len);