wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 422286: fix accounting of array length when slicing dense arrays. r=mrbkap, a=mconnor.

Browse Source
This commit is contained in:
shaver@mozilla.org 2008-03-11 23:50:55 -07:00
parent 49be829b51
commit 1ddc65a4a0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/jsarray.c
View File

@ -2478,7 +2478,7 @@ array_slice(JSContext *cx, uintN argc, jsval *vp)
if (begin > end)
begin = end;
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
if (OBJ_IS_DENSE_ARRAY(cx, obj) && end <= ARRAY_DENSE_LENGTH(obj)) {
nobj = js_NewArrayObject(cx, end - begin, obj->dslots + begin);
if (!nobj)
return JS_FALSE;