# HG changeset patch
# User Jan de Mooij <jdemooij@mozilla.com>
# Date 1468254840 -32400
#      Tue Jul 12 01:34:00 2016 +0900
# Branch THUNDERBIRD3880_2016050308_RELBRANCH
# Node ID 517033059eef57559ee472d965308af00c6886bc
# Parent  a3ffe5c3780ed40657183ce256b9bfb4152f20cb
Bug 1268626 - Use len instead of arr->length() in array_splice_impl. r=Waldo, a=sylvestre

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2537,17 +2537,17 @@
          * simplicity, have the slow-path code do it.  (Also note that the slow
          * path may validly *not* throw -- if all the elements being moved are
          * holes.)
          */
         if (obj->is<ArrayObject>()) {
             Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
             if (arr->lengthIsWritable()) {
                 NativeObject::EnsureDenseResult res =
-                    arr->ensureDenseElements(cx, arr->length(), itemCount - actualDeleteCount);
+                    arr->ensureDenseElements(cx, len, itemCount - actualDeleteCount);
                 if (res == NativeObject::ED_FAILED)
                     return false;
             }
         }
 
         if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
             ArrayObject* aobj = &obj->as<ArrayObject>();
             if (!aobj->maybeCopyElementsForWrite(cx))
