Bug 664009 - Fix a minor array bug that happens to break some code. r=jwalden, a=clegnitto
authorBrendan Eich <brendan@mozilla.org>
Tue, 14 Jun 2011 16:07:29 -0700
changeset 70303 a0113e2614a25d99e1190aa5e84c7adda7e32e09
parent 70302 f98a8ed5238ae64c44c1140e0e021d948f82eb83
child 70304 1d0b9b879d736148b5327be1916abe1b212c1660
push id148
push userjwalden@mit.edu
push dateTue, 14 Jun 2011 23:27:51 +0000
treeherdermozilla-aurora@a0113e2614a2 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjwalden, clegnitto
bugs664009
milestone6.0a2
Bug 664009 - Fix a minor array bug that happens to break some code. r=jwalden, a=clegnitto
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2801,17 +2801,18 @@ array_extra(JSContext *cx, ArrayExtraMod
      * (and pre-size our map return to match our known length, for all cases).
      */
     jsuint newlen;
     JSObject *newarr;
 #ifdef __GNUC__ /* quell GCC overwarning */
     newlen = 0;
     newarr = NULL;
 #endif
-    jsint start = 0, end = length, step = 1;
+    jsuint start = 0, end = length;
+    jsint step = 1;
 
     switch (mode) {
       case REDUCE_RIGHT:
         start = length - 1, end = -1, step = -1;
         /* FALL THROUGH */
       case REDUCE:
         if (length == 0 && argc == 1) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
@@ -2870,17 +2871,17 @@ array_extra(JSContext *cx, ArrayExtraMod
         return JS_FALSE;
 
     MUST_FLOW_THROUGH("out");
     JSBool ok = JS_TRUE;
     JSBool cond;
 
     Value objv = ObjectValue(*obj);
     AutoValueRooter tvr(cx);
-    for (jsint i = start; i != end; i += step) {
+    for (jsuint i = start; i != end; i += step) {
         JSBool hole;
         ok = JS_CHECK_OPERATION_LIMIT(cx) &&
              GetElement(cx, obj, i, &hole, tvr.addr());
         if (!ok)
             goto out;
         if (hole)
             continue;