Fixed js_String_p_split passing in an undersized array.

2008-08-21 15:17:47 -07:00
parent faade237a5
commit 4877f1a9f6
1 changed files with 1 additions and 1 deletions
--- a/js/src/jsbuiltins.cpp
+++ b/js/src/jsbuiltins.cpp
@@ -307,7 +307,7 @@ JSObject* FASTCALL
 js_String_p_split(JSContext* cx, JSString* str, JSString* sepstr)
 {
    // FIXME: optimize by calling into a lower level exported from jsstr.cpp.
-    jsval vp[3] = { JSVAL_NULL, STRING_TO_JSVAL(str), STRING_TO_JSVAL(sepstr) };
+    jsval vp[4] = { JSVAL_NULL, STRING_TO_JSVAL(str), STRING_TO_JSVAL(sepstr), JSVAL_VOID };
    if (!js_str_split(cx, 2, vp))
        return NULL;
    JS_ASSERT(JSVAL_IS_OBJECT(vp[0]));