From a7d7332c7b2613162227d634811ff4e1a366d9b7 Mon Sep 17 00:00:00 2001
From: wolfbeast <mcwerewolf@wolfbeast.com>
Date: Mon, 17 Jun 2019 15:09:05 +0000
Subject: [PATCH] Fix typo in ArrayShiftMoveElements

---
 js/src/jsarray.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 9abc99e347..7af7c98001 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2120,7 +2120,7 @@ js::ArrayShiftMoveElements(NativeObject* obj)
      * decremented and the result fetched, so just shift the array elements
      * themselves.
      */
-    obj->moveDenseElementsNoPreBarrier(0, 1, initlen - 1);
+    obj->moveDenseElementsNoPreBarrier(0, 1, initlen);
 }
 
 static inline void