Bug 575024 JSObject::resizeDenseArrayElements comparison is always false due to limited range of data type

r=dvander
2010-06-28 13:22:52 +03:00
parent 84aa6cbe83
commit 67bcfb0db4
1 changed files with 1 additions and 1 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -337,7 +337,7 @@ JSObject::resizeDenseArrayElements(JSContext *cx, uint32 oldcap, uint32 newcap,
        return JS_TRUE;
    }

-    if (newcap > MAX_DSLOTS_LENGTH) {
+    if (newcap > MAX_DSLOTS_LENGTH32) {
        js_ReportAllocationOverflow(cx);
        return JS_FALSE;
    }