bug 495061 - js_PutArgsObject and js_PutCallObject that never fail. r=brendan

2009-08-14 20:43:16 +02:00
parent f1fc77808a
commit 41c4f687c7
14 changed files with 311 additions and 335 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2398,7 +2398,7 @@ js_ArrayCompPush(JSContext *cx, JSObject *obj, jsval v)
    JS_ASSERT(length <= js_DenseArrayCapacity(obj));

    if (length == js_DenseArrayCapacity(obj)) {
-        if (length >= ARRAY_INIT_LIMIT) {
+        if (length > JS_ARGS_LENGTH_MAX) {
            JS_ReportErrorNumberUC(cx, js_GetErrorMessage, NULL,
                                   JSMSG_ARRAY_INIT_TOO_BIG);
            return JS_FALSE;