diff --git a/dom/base/nsAttrAndChildArray.cpp b/dom/base/nsAttrAndChildArray.cpp index e454fda31e..08be8ef0c5 100644 --- a/dom/base/nsAttrAndChildArray.cpp +++ b/dom/base/nsAttrAndChildArray.cpp @@ -790,7 +790,12 @@ nsAttrAndChildArray::GrowBy(uint32_t aGrowSize) } while (size.value() < minSize.value()); } else { - size = 1u << mozilla::CeilingLog2(minSize.value()); + uint32_t shift = mozilla::CeilingLog2(minSize.value()); + if (shift >= 32) { + return false; + } + + size = 1u << shift; } bool needToInitialize = !mImpl;