Bug 1234397 - dispatch on the correct value. r=luke

--HG--
extra : rebase_source : fe5dc1b57caf1346f58fd3a4785eef656e646447
extra : amend_source : 192d12551a24f7bf5570d212b5ce58e4d3445176

js/src/vm/SharedArrayObject.cpp

@@ -170,7 +170,7 @@ SharedArrayRawBuffer::dropReference()
         uint8_t* address = p.unwrap(/*safe - only reference*/);
         uint32_t allocSize = (this->length + 2*AsmJSPageSize - 1) & ~(AsmJSPageSize - 1);
 #if defined(ASMJS_MAY_USE_SIGNAL_HANDLERS_FOR_OOB)
-        if (!IsValidAsmJSHeapLength(allocSize)) {
+        if (!IsValidAsmJSHeapLength(this->length)) {
             UnmapMemory(address, allocSize);
         } else {
             numLive--;