Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-08 04:27:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[INFER] Fix bogus assert in array_pop_dense, bug 657245.

Browse Source
This commit is contained in:
Brian Hackett 2011-05-15 22:08:10 -07:00
parent 16f0db1371
commit c4716f4f69
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jit-test/tests/basic/bug657245.js Normal file
View File

@ -0,0 +1,4 @@
var length = 4294967295;
var array1 = Array(length);
array1.pop();

2
js/src/jsarray.cpp
View File

@ -2373,7 +2373,7 @@ array_pop_dense(JSContext *cx, JSObject* obj, Value *vp)
if (cx->typeInferenceEnabled() && obj->getDenseArrayInitializedLength() > index)
obj->setDenseArrayInitializedLength(index);
obj->setDenseArrayLength(index);
obj->setArrayLength(cx, index);
return JS_TRUE;
}