[INFER] Fix corruption-inducing typo, bug 642159.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 17 Mar 2011 18:43:09 -0700
changeset 74803 5f46e05ceecb252bb8967e855ba650b1bcd103ac
parent 74802 7085463508eeede7eaa016f28f27e2f584c5112b
child 74804 897c257e54054c790995594c14a408ccfbfacc99
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs642159
milestone2.0b13pre
[INFER] Fix corruption-inducing typo, bug 642159.
js/src/jsinferinlines.h
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -1218,17 +1218,17 @@ inline void
 SweepClonedTypes(ClonedTypeSet *types)
 {
     if (types->objectCount >= 2) {
         for (unsigned i = 0; i < types->objectCount; i++) {
             if (!types->objectSet[i]->marked)
                 types->objectSet[i--] = types->objectSet[--types->objectCount];
         }
         if (types->objectCount == 1) {
-            TypeObject *obj = (TypeObject *) types->objectSet;
+            TypeObject *obj = types->objectSet[0];
             ::js_free(types->objectSet);
             types->objectSet = (TypeObject **) obj;
         } else if (types->objectCount == 0) {
             ::js_free(types->objectSet);
             types->objectSet = NULL;
         }
     } else if (types->objectCount == 1) {
         TypeObject *obj = (TypeObject *) types->objectSet;