Bug 730415 - Fix JS engine OOM condition in makeDenseArraysSlow. r=bhackett

This commit is contained in:
Christian Holler 2012-02-27 12:57:53 -08:00
parent 74f5918c05
commit af33552a20

View File

@ -1389,7 +1389,8 @@ JSObject::makeDenseArraySlow(JSContext *cx)
*/
if (!AddLengthProperty(cx, this)) {
this->shape_ = oldShape;
cx->free_(getElementsHeader());
if (elements != emptyObjectElements)
cx->free_(getElementsHeader());
elements = elems;
return false;
}