Bug 680523 - Vector move constructor needs to initialize mBegin (r=jimb)

--HG--
extra : rebase_source : ea42c66734745bfe5b3c83c10e6c5a42a19c8527

js/src/jshashtable.h

@@ -608,7 +608,7 @@ class HashTable : private AllocPolicy
             memset(table, 0, sizeof(*table) * tableCapacity);
         } else {
             for (Entry *e = table, *end = table + tableCapacity; e != end; ++e)
-                *e = Entry();
+                *e = Move(Entry());
         }
         removedCount = 0;
         entryCount = 0;

js/src/jsvector.h

@@ -506,6 +506,7 @@ Vector<T, N, AllocPolicy>::Vector(MoveRef<Vector> rhs)
 
     if (rhs->usingInlineStorage()) {
         /* We can't move the buffer over in this case, so copy elements. */
+        mBegin = (T *)storage.addr();
         Impl::moveConstruct(mBegin, rhs->beginNoCheck(), rhs->endNoCheck());
         /*
          * Leave rhs's mLength, mBegin, mCapacity, and mReserved as they are.