Fix incorrect use of obj->setDenseArrayLength, bug 699446.

This commit is contained in:
Brian Hackett 2011-11-03 14:20:44 -07:00
parent ff81f4b4d3
commit 5bfbb57aea

View File

@ -3721,7 +3721,7 @@ NewArray(JSContext *cx, jsuint length, JSObject *proto)
return NULL;
/* Fixup the elements pointer and length, which may be incorrect. */
obj->setFixedElements();
obj->setDenseArrayLength(length);
obj->setArrayLength(cx, length);
if (allocateCapacity && !EnsureNewArrayElements(cx, obj, length))
return NULL;
return obj;