Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-14 13:55:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 575024 JSObject::resizeDenseArrayElements comparison is always false due to limited range of data type

Browse Source 
r=dvander

--HG--
extra : rebase_source : 2be13535bf494080eb098ab4c4f9008d7a6feb88
This commit is contained in:
timeless@mozdev.org 2010-06-28 13:22:52 +03:00
parent 261888bbb9
commit f0252e7cbf
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/jsarray.cpp
View File

@ -337,7 +337,7 @@ JSObject::resizeDenseArrayElements(JSContext *cx, uint32 oldcap, uint32 newcap,
return JS_TRUE;
}
if (newcap > MAX_DSLOTS_LENGTH) {
if (newcap > MAX_DSLOTS_LENGTH32) {
js_ReportAllocationOverflow(cx);
return JS_FALSE;
}