Bug 1268626 - Use len instead of arr->length() in array_splice_impl. r=Waldo, a=sylvestre
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2602,17 +2602,17 @@ js::array_splice_impl(JSContext* cx, uns
* simplicity, have the slow-path code do it. (Also note that the slow
* path may validly *not* throw -- if all the elements being moved are
* holes.)
*/
if (obj->is<ArrayObject>()) {
Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
if (arr->lengthIsWritable()) {
DenseElementResult result =
- arr->ensureDenseElements(cx, arr->length(), itemCount - actualDeleteCount);
+ arr->ensureDenseElements(cx, len, itemCount - actualDeleteCount);
if (result == DenseElementResult::Failure)
return false;
}
}
if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
DenseElementResult result =
MoveAnyBoxedOrUnboxedDenseElements(cx, obj, actualStart + itemCount,