Commit 70cd4288 authored by David Anderson's avatar David Anderson
Browse files

Cap objects to a saner memory limit (bug 705855, r=dmandelin). 

--HG--
extra : rebase_source : 551bbcee86d617f3a55a0a3274083ae54af4b294
parent 5cf4a6e5

js/src/jsobj.cpp

+2 −0
Original line number Diff line number Diff line
@@ -117,6 +117,8 @@ using namespace js; 
using namespace js::gc;

using namespace js::types;



JS_STATIC_ASSERT(int32((JSObject::NELEMENTS_LIMIT - 1) * sizeof(Value)) == int64((JSObject::NELEMENTS_LIMIT - 1) * sizeof(Value)));



Class js::ObjectClass = {

    js_Object_str,

    JSCLASS_HAS_CACHED_PROTO(JSProto_Object),

js/src/jsobj.h

+1 −1
Original line number Diff line number Diff line
@@ -531,7 +531,7 @@ struct JSObject : js::gc::Cell 
    inline bool nativeContains(JSContext *cx, const js::Shape &shape);



    /* Upper bound on the number of elements in an object. */

    static const uint32 NELEMENTS_LIMIT = JS_BIT(29);

    static const uint32 NELEMENTS_LIMIT = JS_BIT(28);



  private:

    js::HeapValue   *slots;     /* Slots for object properties. */