[INFER] Fix botched merge.
authorBrian Hackett <bhackett1024@gmail.com>
Wed, 08 Dec 2010 06:52:49 -0800
changeset 74644 7218d92dd3d3eae87d1443b3b442080d76799cb2
parent 74643 eee3770cab7feafe45d058f4c11b19726a0dec77
child 74645 b6cef988a4c04d9e0f8bdd1fc8896652730251d0
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
milestone2.0b8pre
[INFER] Fix botched merge.
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -485,27 +485,30 @@ SetArrayElement(JSContext *cx, JSObject 
 #ifdef JS_TRACER
 JSBool JS_FASTCALL
 js_EnsureDenseArrayCapacity(JSContext *cx, JSObject *obj, jsint i)
 {
 #ifdef DEBUG
     Class *origObjClasp = obj->clasp; 
 #endif
     jsuint u = jsuint(i);
-    JSBool ret = (obj->ensureDenseArrayElements(cx, u, 1) == JSObject::ED_OK);
+    if (obj->ensureDenseArrayElements(cx, u, 1) != JSObject::ED_OK)
+        return false;
 
     /*
      * Write undefined to the element so the tracer doesn't see an uninitialized value
-     * when testing for a hole, and doesn't call dense_setelem_hole.
+     * when testing for a hole.
      */
     obj->setDenseArrayElement(i, UndefinedValue());
+    if (u >= obj->getArrayLength())
+        obj->setArrayLength(cx, u + 1);
 
     /* Partially check the CallInfo's storeAccSet is correct. */
     JS_ASSERT(obj->clasp == origObjClasp);
-    return ret;
+    return true;
 }
 /* This function and its callees do not touch any object's .clasp field. */
 JS_DEFINE_CALLINFO_3(extern, BOOL, js_EnsureDenseArrayCapacity, CONTEXT, OBJECT, INT32,
                      0, nanojit::ACCSET_STORE_ANY & ~tjit::ACCSET_OBJ_CLASP)
 #endif
 
 static JSBool
 DeleteArrayElement(JSContext *cx, JSObject *obj, jsdouble index, JSBool strict)