Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 05:41:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1312948: Put assertions in place to know we're not mutating the length when the array is frozen. r=nbp

Browse Source 
MozReview-Commit-ID: 84X0Sgm7pGe
Signed-off-by: Emilio Cobos Álvarez <ecoal95@gmail.com>
This commit is contained in:
Emilio Cobos Álvarez 2016-10-26 12:04:49 +02:00
parent 7a8a1e5e91
commit 3cc8730024
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/src/vm/ArrayObject-inl.h
View File

@ -23,6 +23,7 @@ inline void
ArrayObject::setLength(ExclusiveContext* cx, uint32_t length)
{
MOZ_ASSERT(lengthIsWritable());
MOZ_ASSERT_IF(length != getElementsHeader()->length, !denseElementsAreFrozen());
if (length > INT32_MAX) {
/* Track objects with overflowing lengths in type information. */