Don't use broken js_NewArrayObjectWithCapacity API (581264, r=bz,jst,dwitte).

content/base/src/nsFrameMessageManager.cpp

@@ -222,26 +222,20 @@ nsFrameMessageManager::SendSyncMessage()
       JSAutoRequest ar(ctx);
 
       PRUint32 len = retval.Length();
-      jsval* dest = nsnull;
-      JSObject* dataArray = js_NewArrayObjectWithCapacity(ctx, len, &dest);
+      JSObject* dataArray = js_NewArrayObject(ctx, len, NULL);
       NS_ENSURE_TRUE(dataArray, NS_ERROR_OUT_OF_MEMORY);
-      nsAutoGCRoot arrayGCRoot(&dataArray, &rv);
-      NS_ENSURE_SUCCESS(rv, rv);
 
       for (PRUint32 i = 0; i < len; ++i) {
-        dest[i] = JSVAL_NULL;
         if (!retval[i].Length())
           continue;
 
         jsval ret = JSVAL_VOID;
-        nsAutoGCRoot root(&ret, &rv);
-        NS_ENSURE_SUCCESS(rv, rv);
         JSONParser* parser = JS_BeginJSONParse(ctx, &ret);
         JSBool ok = JS_ConsumeJSONText(ctx, parser, (jschar*)retval[i].get(),
                                        (uint32)retval[i].Length());
         ok = JS_FinishJSONParse(ctx, parser, JSVAL_NULL) && ok;
         if (ok) {
-          dest[i] = ret;
+          NS_ENSURE_TRUE(JS_SetElement(ctx, dataArray, i, &ret), NS_ERROR_OUT_OF_MEMORY);
         }
       }
 
@@ -350,10 +344,9 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
         // To keep compatibility with e10s message manager,
         // define empty objects array.
         if (!aObjectsArray) {
-          jsval* dest = nsnull;
           // Because we want JS messages to have always the same properties,
           // create array even if len == 0.
-          aObjectsArray = js_NewArrayObjectWithCapacity(ctx, 0, &dest);
+          aObjectsArray = js_NewArrayObject(ctx, 0, NULL);
           if (!aObjectsArray) {
             return false;
           }

content/canvas/src/nsCanvasRenderingContext2D.cpp

@@ -3825,14 +3825,6 @@ nsCanvasRenderingContext2D::AsyncDrawXULElement(nsIDOMXULElement* aElem, float a
 //
 // device pixel getting/setting
 //
-extern "C" {
-#include "jstypes.h"
-JS_FRIEND_API(JSBool)
-js_CoerceArrayToCanvasImageData(JSObject *obj, jsuint offset, jsuint count,
-                                JSUint8 *dest);
-JS_FRIEND_API(JSObject *)
-js_NewArrayObjectWithCapacity(JSContext *cx, jsuint capacity, jsval **vector);
-}
 
 void
 nsCanvasRenderingContext2D::EnsureUnpremultiplyTable() {

js/src/ctypes/CTypes.cpp

@@ -3911,16 +3911,15 @@ ExtractStructField(JSContext* cx, jsval val, JSObject** typeObj)
   return name;
 }
 
-// For a struct field with 'name' and 'type', add an element to field
-// descriptor array 'arrayObj' of the form { name : type }.
+// For a struct field with 'name' and 'type', add an element of the form
+// { name : type }.
 static JSBool
 AddFieldToArray(JSContext* cx,
-                JSObject* arrayObj,
                 jsval* element,
                 JSString* name,
                 JSObject* typeObj)
 {
-  JSObject* fieldObj = JS_NewObject(cx, NULL, NULL, arrayObj);
+  JSObject* fieldObj = JS_NewObject(cx, NULL, NULL, NULL);
   if (!fieldObj)
     return false;
 
@@ -4325,22 +4324,22 @@ StructType::BuildFieldsArray(JSContext* cx, JSObject* obj)
   size_t len = fields->count();
 
   // Prepare a new array for the 'fields' property of the StructType.
-  jsval* fieldsVec;
-  JSObject* fieldsProp =
-    js_NewArrayObjectWithCapacity(cx, len, &fieldsVec);
-  if (!fieldsProp)
+  Array<jsval, 16> fieldsVec;
+  if (!fieldsVec.resize(len))
     return NULL;
-  js::AutoObjectRooter root(cx, fieldsProp);
-  JS_ASSERT(len == 0 || fieldsVec);
 
   for (FieldInfoHash::Range r = fields->all(); !r.empty(); r.popFront()) {
     const FieldInfoHash::Entry& entry = r.front();
     // Add the field descriptor to the array.
-    if (!AddFieldToArray(cx, fieldsProp, &fieldsVec[entry.value.mIndex],
-           entry.key, entry.value.mType))
+    if (!AddFieldToArray(cx, &fieldsVec[entry.value.mIndex],
+                         entry.key, entry.value.mType))
       return NULL;
   }
 
+  JSObject* fieldsProp = JS_NewArrayObject(cx, len, fieldsVec.begin());
+  if (!fieldsProp)
+    return NULL;
+
   // Seal the fields array.
   if (!JS_SealObject(cx, fieldsProp, JS_FALSE))
     return NULL;