[INFER] Fix bogus assert in array_pop_dense, bug 657245.

2011-05-15 22:08:10 -07:00
parent d997734630
commit 26008b2e7f
2 changed files with 5 additions and 1 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2373,7 +2373,7 @@ array_pop_dense(JSContext *cx, JSObject* obj, Value *vp)

    if (cx->typeInferenceEnabled() && obj->getDenseArrayInitializedLength() > index)
        obj->setDenseArrayInitializedLength(index);
-    obj->setDenseArrayLength(index);
+    obj->setArrayLength(cx, index);
    return JS_TRUE;
 }