[webkit-reviews] review granted: [Bug 120278] JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage does a check on the length of the ArrayStorage after possible reallocing it : [Attachment 209609] Patch

[bugzilla-daemon at webkit.org]

Geoffrey Garen <ggaren at apple.com> has granted Mark Hahnenberg
<mhahnenberg at apple.com>'s request for review:
Bug 120278: JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage does a
check on the length of the ArrayStorage after possible reallocing it
https://bugs.webkit.org/show_bug.cgi?id=120278

Attachment 209609: Patch
https://bugs.webkit.org/attachment.cgi?id=209609&action=review

------- Additional Comments from Geoffrey Garen <ggaren at apple.com>
Can you add a test case for this?