Backout merge, a=backout
authorDavid Mandelin <dmandelin@mozilla.com>
Mon, 22 Nov 2010 15:22:17 -0800
changeset 58010 09e869b8ff890912d47d314ce65d2375d2532527
parent 58008 1a55741b7b27f1cd13da1086c5918ddbf79ad013 (current diff)
parent 58009 f6c4f42d7b28ea789b2ab88ce2717d33c9b3efe9 (diff)
child 58011 508fe9b3ecf1b2088c7f4a361bba891e233bd5c6
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersbackout
milestone2.0b8pre
Backout merge, a=backout
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -1251,22 +1251,16 @@ ValueToNumberSlow(JSContext *cx, Value v
         if (v.isNull()) {
             *out = 0.0;
             return true;
         }
         if (v.isUndefined())
             break;
 
         JS_ASSERT(v.isObject());
-        if (!v.isObject()) {
-            if (v.isMagic(JS_ARRAY_HOLE))
-                *(int *) 0x88 = 0;
-            else
-                *(int *) 0x99 = 0;
-        }
         if (!DefaultValue(cx, &v.toObject(), JSTYPE_NUMBER, &v))
             return false;
         if (v.isObject())
             break;
     }
 
     *out = js_NaN;
     return true;