Fix FastNewObject built-in to create dense array instance with its own map.

2008-08-11 15:03:32 -07:00
parent 6e5b7799d4
commit 2b077258a5
1 changed files with 8 additions and 1 deletions
--- a/js/src/jsbuiltins.cpp
+++ b/js/src/jsbuiltins.cpp
@@ -372,7 +372,14 @@ js_FastNewObject(JSContext* cx, JSObject* ctor)
    for (; i != JS_INITIAL_NSLOTS; ++i)
        obj->fslots[i] = JSVAL_VOID;

-    obj->map = js_HoldObjectMap(cx, proto->map);
+    if (clasp == &js_ArrayClass) {
+        JSObjectOps* ops = clasp->getObjectOps(cx, clasp);
+        obj->map = ops->newObjectMap(cx, 1, ops, clasp, obj);
+        if (!obj->map)
+            return NULL;
+    } else {
+        obj->map = js_HoldObjectMap(cx, proto->map);
+    }
    obj->dslots = NULL;
    return obj;
 }