Likely gmail bustage fix

2009-05-11 15:41:00 -07:00
parent a8edad7be0
commit d1e563b390
1 changed files with 2 additions and 1 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2719,7 +2719,8 @@ array_splice(JSContext *cx, uintN argc, jsval *vp)
        delta = (jsuint)argc - count;
        last = length;
        if (OBJ_IS_DENSE_ARRAY(cx, obj) && !js_PrototypeHasIndexedProperties(cx, obj) &&
-            length <= js_DenseArrayCapacity(obj) && obj->dslots[length - 1] != JSVAL_HOLE) {
+            length <= js_DenseArrayCapacity(obj) &&
+            (length == 0 || obj->dslots[length - 1] != JSVAL_HOLE)) {
            if (!EnsureCapacity(cx, obj, length + delta))
                return JS_FALSE;
            /* (uint) end could be 0, so we can't use a vanilla >= test. */