Move JSObject::parent to BaseShape, bug 638316.

2011-10-13 20:21:36 -07:00
parent ae4d37bb0d
commit 7532089095
41 changed files with 433 additions and 365 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1338,7 +1338,8 @@ JSObject::makeDenseArraySlow(JSContext *cx)

    /* Create a native scope. */
    gc::AllocKind kind = getAllocKind();
-    if (!InitScopeForObject(cx, this, &SlowArrayClass, getProto()->getNewType(cx), kind)) {
+    if (!InitScopeForObject(cx, this, &SlowArrayClass, oldShape->getObjectParent(),
+                            getProto()->getNewType(cx), kind)) {
        setLastPropertyInfallible(oldShape);
        return false;
    }