diff options
| author | Pale Moon <git-repo@palemoon.org> | 2017-10-04 17:42:35 +0200 |
|---|---|---|
| committer | Pale Moon <git-repo@palemoon.org> | 2017-10-04 17:42:35 +0200 |
| commit | 47b806fc29c644124ab4ab11bcb2459694c375b3 (patch) | |
| tree | dd818e648f6e282e3edb905aa22220add656c17b | |
| parent | 5c8d951700486977f1742cdec2a91417c947e70e (diff) | |
| download | palemoon-gre-47b806fc29c644124ab4ab11bcb2459694c375b3.tar.gz | |
Fix a potential reference issue in JS arrays.
Found with SA.
| -rw-r--r-- | js/src/jsarray.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp index 566462fd7..a43afc437 100644 --- a/js/src/jsarray.cpp +++ b/js/src/jsarray.cpp @@ -980,7 +980,7 @@ ArrayJoinKernel(JSContext* cx, SeparatorOp sepOp, HandleObject obj, uint32_t len if (!CheckForInterrupt(cx)) return false; - const Value& elem = obj->as<ArrayObject>().getDenseElement(i); + Value elem = obj->as<ArrayObject>().getDenseElement(i); if (elem.isString()) { if (!sb.append(elem.toString())) |