Bug 506894 - Crash - e4x/GC/regress-357063-01.js. r=gal
This commit is contained in:
@@ -932,8 +932,12 @@ XMLArraySetCapacity(JSContext *cx, JSXMLArray *array, uint32 capacity)
|
|||||||
|
|
||||||
if (capacity == 0) {
|
if (capacity == 0) {
|
||||||
/* We could let realloc(p, 0) free this, but purify gets confused. */
|
/* We could let realloc(p, 0) free this, but purify gets confused. */
|
||||||
if (array->vector)
|
if (array->vector) {
|
||||||
cx->free(array->vector);
|
if (cx)
|
||||||
|
cx->free(array->vector);
|
||||||
|
else
|
||||||
|
js_free(array->vector);
|
||||||
|
}
|
||||||
vector = NULL;
|
vector = NULL;
|
||||||
} else {
|
} else {
|
||||||
if (
|
if (
|
||||||
|
|||||||
Reference in New Issue
Block a user