From e0329e27a7c0f7106c77d5a9faf0410310450cd6 Mon Sep 17 00:00:00 2001
From: "shaver%mozilla.org"
 <shaver%mozilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 12 Mar 2008 06:50:55 +0000
Subject: [PATCH] Bug 422286: fix accounting of array length when slicing dense
 arrays. r=mrbkap, a=mconnor.

git-svn-id: svn://10.0.0.236/trunk@247605 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/js/src/jsarray.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mozilla/js/src/jsarray.c b/mozilla/js/src/jsarray.c
index c68964e601d..53b1ed7188b 100644
--- a/mozilla/js/src/jsarray.c
+++ b/mozilla/js/src/jsarray.c
@@ -2478,7 +2478,7 @@ array_slice(JSContext *cx, uintN argc, jsval *vp)
     if (begin > end)
         begin = end;
 
-    if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
+    if (OBJ_IS_DENSE_ARRAY(cx, obj) && end <= ARRAY_DENSE_LENGTH(obj)) {
         nobj = js_NewArrayObject(cx, end - begin, obj->dslots + begin);
         if (!nobj)
             return JS_FALSE;