Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 422286: fix accounting of array length when slicing dense arrays.

Browse Source 
r=mrbkap, a=mconnor.


git-svn-id: svn://10.0.0.236/trunk@247605 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
shaver%mozilla.org
2008-03-12 06:50:55 +00:00
parent bcc0b9a423
commit e0329e27a7
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/js/src/jsarray.c
View File

@@ -2478,7 +2478,7 @@ array_slice(JSContext *cx, uintN argc, jsval *vp)
if (begin > end)
begin = end;
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
if (OBJ_IS_DENSE_ARRAY(cx, obj) && end <= ARRAY_DENSE_LENGTH(obj)) {
nobj = js_NewArrayObject(cx, end - begin, obj->dslots + begin);
if (!nobj)
return JS_FALSE;