575024 - JSObject::resizeDenseArrayElements comparison is always false due to limited range of data type

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[timeless]

js/src/jsarray.cpp: In member function ‘bool JSObject::resizeDenseArrayElements(JSContext*, uint32, uint32, bool)’:
340: warning: comparison is always false due to limited range of data type

Comment 1

[timeless]

Attachment: patch

Comment 2

[timeless]

http://hg.mozilla.org/mozilla-central/rev/eece34b864ed

Comment 3

[Daniel Veditz [:dveditz]]

Comment on attachment 454320 [details] [diff] [review]
patch

Nice safe stability win for branches.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 454320 [details] [diff] [review]
patch

patch doesn't apply on 1.9.1 because, trivially, the param was called "size" rather than "newlen", but also there is no MAX_DSLOTS_LENGTH32. Also the function patched is static ResizeSlots() rather than JSObject::resizeDesnseArrayElements() but that probably doesn't matter.

Comment 5

[Reed Loden [:reed]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/1207bf8fed24

Comment 6

[Daniel Veditz [:dveditz]]

Attachment: 1.9.1 port

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 494601 [details] [diff] [review]
1.9.1 port

Got verbal r+ from dvander

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 494601 [details] [diff] [review]
1.9.1 port

Not going to respin 1.9.1.16 so .17 it is.

Comment 9

[Daniel Veditz [:dveditz]]

reassigning to myself so i remember to land it this time.

Comment 10

[Daniel Veditz [:dveditz]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/ed88e6a66ef9