Cap objects to a saner memory limit (bug 705855, r=dmandelin).

--HG--
extra : rebase_source : 551bbcee86d617f3a55a0a3274083ae54af4b294
This commit is contained in:
David Anderson 2011-12-08 17:46:39 -08:00
parent 2d2a1931b2
commit c552bd7c52
2 changed files with 3 additions and 1 deletions

View File

@ -117,6 +117,8 @@ using namespace js;
using namespace js::gc;
using namespace js::types;
JS_STATIC_ASSERT(int32((JSObject::NELEMENTS_LIMIT - 1) * sizeof(Value)) == int64((JSObject::NELEMENTS_LIMIT - 1) * sizeof(Value)));
Class js::ObjectClass = {
js_Object_str,
JSCLASS_HAS_CACHED_PROTO(JSProto_Object),

View File

@ -531,7 +531,7 @@ struct JSObject : js::gc::Cell
inline bool nativeContains(JSContext *cx, const js::Shape &shape);
/* Upper bound on the number of elements in an object. */
static const uint32 NELEMENTS_LIMIT = JS_BIT(29);
static const uint32 NELEMENTS_LIMIT = JS_BIT(28);
private:
js::HeapValue *slots; /* Slots for object properties. */