From 085993a2c62f14c79f11eaca677a41589e167dd0 Mon Sep 17 00:00:00 2001
From: Kyle Machulis <kyle@nonpolynomial.com>
Date: Mon, 20 Aug 2012 18:26:44 -0700
Subject: [PATCH] Bug 783431 - Fix js array initialization for bluetooth and
 telephony; r=mrbkap

---
 dom/bluetooth/BluetoothUtils.cpp | 7 ++++---
 dom/telephony/Telephony.cpp      | 4 ++--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/dom/bluetooth/BluetoothUtils.cpp b/dom/bluetooth/BluetoothUtils.cpp
index 05dccfb19ed1..cd0befd0d535 100644
--- a/dom/bluetooth/BluetoothUtils.cpp
+++ b/dom/bluetooth/BluetoothUtils.cpp
@@ -34,7 +34,7 @@ mozilla::dom::bluetooth::StringArrayToJSArray(JSContext* aCx, JSObject* aGlobal,
   } else {
     uint32_t valLength = aSourceArray.Length();
     mozilla::ScopedDeleteArray<jsval> valArray(new jsval[valLength]);
-    JS::AutoArrayRooter tvr(aCx, valLength, valArray);
+    JS::AutoArrayRooter tvr(aCx, 0, valArray);
     for (PRUint32 index = 0; index < valLength; index++) {
       JSString* s = JS_NewUCStringCopyN(aCx, aSourceArray[index].BeginReading(),
                                         aSourceArray[index].Length());
@@ -43,6 +43,7 @@ mozilla::dom::bluetooth::StringArrayToJSArray(JSContext* aCx, JSObject* aGlobal,
         return NS_ERROR_OUT_OF_MEMORY;
       }
       valArray[index] = STRING_TO_JSVAL(s);
+      tvr.changeLength(index + 1);
     }
     arrayObj = JS_NewArrayObject(aCx, valLength, valArray);
   }
@@ -83,14 +84,14 @@ mozilla::dom::bluetooth::BluetoothDeviceArrayToJSArray(JSContext* aCx, JSObject*
   } else {
     uint32_t valLength = aSourceArray.Length();
     mozilla::ScopedDeleteArray<jsval> valArray(new jsval[valLength]);
-    JS::AutoArrayRooter tvr(aCx, valLength, valArray);
+    JS::AutoArrayRooter tvr(aCx, 0, valArray);
     for (PRUint32 index = 0; index < valLength; index++) {
       nsISupports* obj = aSourceArray[index]->ToISupports();
       nsresult rv =
         nsContentUtils::WrapNative(aCx, aGlobal, obj, &valArray[index]);
       NS_ENSURE_SUCCESS(rv, rv);
+      tvr.changeLength(index + 1);
     }
-
     arrayObj = JS_NewArrayObject(aCx, valLength, valArray);
   }
 
diff --git a/dom/telephony/Telephony.cpp b/dom/telephony/Telephony.cpp
index a65c3eacc62e..7ba623875111 100644
--- a/dom/telephony/Telephony.cpp
+++ b/dom/telephony/Telephony.cpp
@@ -56,14 +56,14 @@ nsTArrayToJSArray(JSContext* aCx, JSObject* aGlobal,
   } else {
     uint32_t valLength = aSourceArray.Length();
     mozilla::ScopedDeleteArray<jsval> valArray(new jsval[valLength]);
-    JS::AutoArrayRooter tvr(aCx, valLength, valArray);
+    JS::AutoArrayRooter tvr(aCx, 0, valArray);
     for (PRUint32 index = 0; index < valLength; index++) {
       nsISupports* obj = aSourceArray[index]->ToISupports();
       nsresult rv =
         nsContentUtils::WrapNative(aCx, aGlobal, obj, &valArray[index]);
       NS_ENSURE_SUCCESS(rv, rv);
+      tvr.changeLength(index + 1);
     }
-
     arrayObj = JS_NewArrayObject(aCx, valLength, valArray);
   }