mirror of
https://github.com/roytam1/palemoon27.git
synced 2026-05-26 14:30:27 +00:00
Fix a potential reference issue in JS arrays.
Found with SA.
This commit is contained in:
+1
-1
@@ -980,7 +980,7 @@ ArrayJoinKernel(JSContext* cx, SeparatorOp sepOp, HandleObject obj, uint32_t len
|
||||
if (!CheckForInterrupt(cx))
|
||||
return false;
|
||||
|
||||
const Value& elem = obj->as<ArrayObject>().getDenseElement(i);
|
||||
Value elem = obj->as<ArrayObject>().getDenseElement(i);
|
||||
|
||||
if (elem.isString()) {
|
||||
if (!sb.append(elem.toString()))
|
||||
|
||||
Reference in New Issue
Block a user