Bug 1268626 - Use len instead of arr->length() in array_splice_impl. r=Waldo
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 22 Jun 2016 16:30:14 +0200
changeset 302338 fdd1161f445604e720214966a7eaed8e7833ad9e
parent 302337 812e027b2adeaadb9b11db9303327300512a2ec9
child 302339 0ad7433c21592e1bc58fa87c4272d95d1660d49f
push id78701
push userjandemooij@gmail.com
push dateWed, 22 Jun 2016 14:31:09 +0000
treeherdermozilla-inbound@fdd1161f4456 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersWaldo
bugs1268626
milestone50.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1268626 - Use len instead of arr->length() in array_splice_impl. r=Waldo
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2602,17 +2602,17 @@ js::array_splice_impl(JSContext* cx, uns
          * simplicity, have the slow-path code do it.  (Also note that the slow
          * path may validly *not* throw -- if all the elements being moved are
          * holes.)
          */
         if (obj->is<ArrayObject>()) {
             Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
             if (arr->lengthIsWritable()) {
                 DenseElementResult result =
-                    arr->ensureDenseElements(cx, arr->length(), itemCount - actualDeleteCount);
+                    arr->ensureDenseElements(cx, len, itemCount - actualDeleteCount);
                 if (result == DenseElementResult::Failure)
                     return false;
             }
         }
 
         if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
             DenseElementResult result =
                 MoveAnyBoxedOrUnboxedDenseElements(cx, obj, actualStart + itemCount,