Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-02 14:30:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 328556: Proper accounting for growth in array_join_sub when reallocating

Browse Source 
chars array. r=mrbkap
This commit is contained in:
igor%mir2.org 2006-02-27 17:32:22 +00:00
parent 4da6f35ea6
commit 1b5685357f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jsarray.c
View File

@ -426,8 +426,8 @@ array_join_sub(JSContext *cx, JSObject *obj, enum ArrayToStringOp op,
} else {
MAKE_SHARP(he);
nchars = js_strlen(chars);
chars = (jschar *)
realloc((ochars = chars), nchars * sizeof(jschar) + growth);
growth += nchars * sizeof(jschar);
chars = (jschar *)realloc((ochars = chars), growth);
if (!chars) {
free(ochars);
goto done;