[INFER] Allow the same shape to be shared by objects with different types, bug 674621.

2011-07-28 14:17:42 -07:00
parent 717e7177ae
commit b8c5a9a940
12 changed files with 75 additions and 102 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1029,7 +1029,7 @@ JSObject::makeDenseArraySlow(JSContext *cx)

    /* Create a native scope. */
    js::gc::FinalizeKind kind = js::gc::FinalizeKind(arenaHeader()->getThingKind());
-    if (!InitScopeForObject(cx, this, &js_SlowArrayClass, getType(cx), kind))
+    if (!InitScopeForObject(cx, this, &js_SlowArrayClass, getProto()->getNewType(cx), kind))
        return false;

    backfillDenseArrayHoles(cx);