From: Brendan Eich <brendan@mozilla.org>
Date: Tue, 14 Jun 2011 16:03:08 -0700
Subject: Bug 664009 - Fix a minor array bug that happens to break some code.
 r=jwalden, a=clegnitto

---
 js/src/jsarray.cpp |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 34a60f7..a9b32f1 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -3047,7 +3047,8 @@ array_extra(JSContext *cx, ArrayExtraMode mode, uintN argc, jsval *vp)
     jsval *argv, *elemroot, *invokevp, *sp;
     JSBool ok, cond, hole;
     JSObject *callable, *thisp, *newarr;
-    jsint start, end, step, i;
+    jsuint start, end, i;
+    jsint step;
     void *mark;
 
     obj = JS_THIS_OBJECT(cx, vp);
