Bug 1268626 - Use len instead of arr->length() in array_splice_impl. r=Waldo, a=sylvestre
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 22 Jun 2016 16:30:14 +0200
changeset 339671 d4e7738bd2aa5a523ca2551c467458c9f3eac45a
parent 339670 df1161c9fc743c674d91607444a95254acd9d64b
child 339672 1e6a6a67f97b16f040d8adba4f9fc5756168311b
push id6249
push userjlund@mozilla.com
push dateMon, 01 Aug 2016 13:59:36 +0000
treeherdermozilla-beta@bad9d4f5bf7e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersWaldo, sylvestre
bugs1268626
milestone49.0a2
Bug 1268626 - Use len instead of arr->length() in array_splice_impl. r=Waldo, a=sylvestre
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2602,17 +2602,17 @@ js::array_splice_impl(JSContext* cx, uns
          * simplicity, have the slow-path code do it.  (Also note that the slow
          * path may validly *not* throw -- if all the elements being moved are
          * holes.)
          */
         if (obj->is<ArrayObject>()) {
             Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
             if (arr->lengthIsWritable()) {
                 DenseElementResult result =
-                    arr->ensureDenseElements(cx, arr->length(), itemCount - actualDeleteCount);
+                    arr->ensureDenseElements(cx, len, itemCount - actualDeleteCount);
                 if (result == DenseElementResult::Failure)
                     return false;
             }
         }
 
         if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
             DenseElementResult result =
                 MoveAnyBoxedOrUnboxedDenseElements(cx, obj, actualStart + itemCount,