bug 505315 - constructing GC free lists during finalization. r=brendan

2009-10-16 10:10:54 +04:00
parent 44fb6655c5
commit d3ed67924f
9 changed files with 494 additions and 544 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -3463,7 +3463,7 @@ js_NewArrayObject(JSContext *cx, jsuint length, jsval *vector, JSBool holey)
    JS_POP_TEMP_ROOT(cx, &tvr);

    /* Set/clear newborn root, in case we lost it.  */
-    cx->weakRoots.newbornObject = obj;
+    cx->weakRoots.finalizableNewborns[FINALIZE_OBJECT] = obj;
    return obj;
 }