1 files changed, 3 insertions, 9 deletions
diff --git a/dom/base/nsMappedAttributes.cpp b/dom/base/nsMappedAttributes.cpp
index 825409adc4..949297c489 100644
--- a/dom/base/nsMappedAttributes.cpp
+++ b/dom/base/nsMappedAttributes.cpp
@@ -61,17 +61,11 @@ nsMappedAttributes::Clone(bool aWillAddAttr)
 
 void* nsMappedAttributes::operator new(size_t aSize, uint32_t aAttrCount) CPP_THROW_NEW
 {
-  size_t size = aSize + aAttrCount * sizeof(InternalAttr);
+  NS_ASSERTION(aAttrCount > 0, "zero-attribute nsMappedAttributes requested");
 
   // aSize will include the mAttrs buffer so subtract that.
-  // We don't want to under-allocate, however, so do not subtract
-  // if we have zero attributes. The zero attribute case only happens
-  // for <body>'s mapped attributes
-  if (aAttrCount != 0) {
-    size -= sizeof(void*[1]);
-  }
-
-  void* newAttrs = ::operator new(size);
+  void* newAttrs = ::operator new(aSize - sizeof(void*[1]) +
+                                  aAttrCount * sizeof(InternalAttr));
 
 #ifdef DEBUG
   static_cast<nsMappedAttributes*>(newAttrs)->mBufferSize = aAttrCount;