Root correct array during makeDenseArraySlow, bug 698148.

2011-10-30 08:50:58 -07:00
parent e40f539638
commit 4034938ba3
1 changed files with 1 additions and 1 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1389,7 +1389,7 @@ JSObject::makeDenseArraySlow(JSContext *cx)
    elements = emptyObjectElements;

    /* Root all values in the array during conversion. */
-    AutoValueArray autoArray(cx, elements, arrayInitialized);
+    AutoValueArray autoArray(cx, elems, arrayInitialized);

    /*
     * Begin with the length property to share more of the property tree.