corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[INFER] Fix incorrect use of getDenseArrayCapacity, bug 617745.

Browse Source
This commit is contained in:
Brian Hackett
2010-12-11 07:07:02 -08:00
parent fc04535f61
commit 4dd6d8d8ea
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/jsarray.cpp
View File

@@ -2451,7 +2451,7 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
break;
if (js_PrototypeHasIndexedProperties(cx, obj))
break;
if (length > obj->getDenseArrayCapacity())
if (length > obj->getDenseArrayInitializedLength())
break;
if (length != 0 && obj->getDenseArrayElement(length - 1).isMagic(JS_ARRAY_HOLE))
break;