Bug 566651 - Actually store the result in vp. r=jorendorff

2010-06-08 09:12:52 -07:00
parent b6eb8dc2a8
commit 3e542e4bad
3 changed files with 26 additions and 0 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -225,6 +225,10 @@ ValueIsLength(JSContext *cx, jsval* vp)
    length = (jsuint) d;
    if (d != (jsdouble) length)
        goto error;
+    if (!js_NewNumberInRootedValue(cx, d, vp)) {
+        *vp = JSVAL_NULL;
+        return 0;
+    }
    return length;

  error: