[INFER] Update initialized length in array_pop_dense, bug 651451. r=bhackett

2011-04-20 18:10:59 +02:00
parent 0075256fc7
commit b63f63bb7f
2 changed files with 6 additions and 0 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2353,6 +2353,8 @@ array_pop_dense(JSContext *cx, JSObject* obj, Value *vp)
    if (!hole && DeleteArrayElement(cx, obj, index, true) < 0)
        return JS_FALSE;

+    if (cx->typeInferenceEnabled())
+        obj->setDenseArrayInitializedLength(index);
    obj->setDenseArrayLength(index);
    return JS_TRUE;
 }