[INFER] Fixes for jstests, bug 620599, part 1.

2010-12-21 07:32:21 -08:00
parent 8cb3a40a31
commit 943ffa00ec
11 changed files with 170 additions and 56 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -3366,6 +3366,10 @@ js_Array(JSContext *cx, uintN argc, Value *vp)
    if (cx->isTypeCallerMonitored())
        cx->markTypeObjectUnknownProperties(type);

+    /* If the length calculation overflowed, make sure that is marked for the new type. */
+    if (obj->getArrayLength() > INT32_MAX)
+        obj->setArrayLength(cx, obj->getArrayLength());
+
    vp->setObject(*obj);
    return JS_TRUE;
 }