Root correct array during makeDenseArraySlow, bug 698148.
authorBrian Hackett <bhackett1024@gmail.com>
Sun, 30 Oct 2011 08:50:58 -0700
changeset 82924 f951e9151626a490a37a3c12f3b3c5d084a56dc0
parent 82923 6c7f986274b9febcd65ad64813e45c7c581998ff
child 82925 d6352d960dd24bb29dc3365b9b2e686e7fbcd812
push id519
push userakeybl@mozilla.com
push dateWed, 01 Feb 2012 00:38:35 +0000
treeherdermozilla-beta@788ea1ef610b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs698148
milestone10.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Root correct array during makeDenseArraySlow, bug 698148.
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1384,17 +1384,17 @@ JSObject::makeDenseArraySlow(JSContext *
         return false;
     }
 
     /* Take ownership of the dense elements, reset to an empty dense array. */
     Value *elems = elements;
     elements = emptyObjectElements;
 
     /* Root all values in the array during conversion. */
-    AutoValueArray autoArray(cx, elements, arrayInitialized);
+    AutoValueArray autoArray(cx, elems, arrayInitialized);
 
     /*
      * Begin with the length property to share more of the property tree.
      * The getter/setter here will directly access the object's private value.
      */
     if (!AddLengthProperty(cx, this)) {
         setLastPropertyInfallible(oldShape);
         cx->free_(getElementsHeader());