[INFER] Restore stock JM behavior with inference off, bug 647048.

2011-03-31 18:11:41 -07:00
parent 8e2f0d4811
commit 34e3947863
16 changed files with 270 additions and 79 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -3496,8 +3496,12 @@ NewArray(JSContext *cx, jsuint length, JSObject *proto)
    if (!obj->setArrayLength(cx, length))
        return NULL;

-    if (allocateCapacity && !obj->ensureSlots(cx, length))
-        return NULL;
+    if (allocateCapacity) {
+        if (!obj->ensureSlots(cx, length))
+            return NULL;
+        if (!cx->typeInferenceEnabled())
+            obj->backfillDenseArrayHoles();
+    }

    return obj;
 }