Check in fix from Brian Crowder <crowder@fiverocks.com> to raise apply arg array length limit (350256, r=me).

js/src/jsarray.h

@@ -47,6 +47,9 @@
 
 JS_BEGIN_EXTERN_C
 
+/* Generous sanity-bound on length (in elements) of array initialiser. */
+#define ARRAY_INIT_LIMIT        JS_BIT(24)
+
 extern JSBool
 js_IdIsIndex(jsval id, jsuint *indexp);
 

js/src/jsfun.c

@@ -1666,7 +1666,7 @@ fun_apply(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
         return JS_FALSE;
 
     /* Allocate stack space for fval, obj, and the args. */
-    argc = (uintN)JS_MIN(length, ARGC_LIMIT - 1);
+    argc = (uintN)JS_MIN(length, ARRAY_INIT_LIMIT - 1);
     sp = js_AllocStack(cx, 2 + argc, &mark);
     if (!sp)
         return JS_FALSE;
@@ -1719,8 +1719,8 @@ fun_applyConstructor(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     if (!js_GetLengthProperty(cx, aobj, &length))
         return JS_FALSE;
 
-    if (length >= ARGC_LIMIT)
-        length = ARGC_LIMIT - 1;
+    if (length >= ARRAY_INIT_LIMIT)
+        length = ARRAY_INIT_LIMIT - 1;
     newsp = sp = js_AllocStack(cx, 2 + length, &mark);
     if (!sp)
         return JS_FALSE;

js/src/jsparse.c

@@ -59,6 +59,7 @@
 #include "jsarena.h" /* Added by JSIFY */
 #include "jsutil.h" /* Added by JSIFY */
 #include "jsapi.h"
+#include "jsarray.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsconfig.h"
@@ -5117,9 +5118,6 @@ js_ParseXMLTokenStream(JSContext *cx, JSObject *chain, JSTokenStream *ts,
 
 #endif /* JS_HAS_XMLSUPPORT */
 
-/* Generous sanity-bound on length (in elements) of array initialiser. */
-#define ARRAY_INIT_LIMIT        JS_BIT(24)
-
 static JSParseNode *
 PrimaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
             JSTokenType tt, JSBool afterDot)

js/src/jsstr.c

@@ -2301,7 +2301,7 @@ str_fromCharCode(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     uint16 code;
     JSString *str;
 
-    JS_ASSERT(argc < ARGC_LIMIT);
+    JS_ASSERT(argc < ARRAY_INIT_LIMIT);
     chars = (jschar *) JS_malloc(cx, (argc + 1) * sizeof(jschar));
     if (!chars)
         return JS_FALSE;