From 3ce496786e5cd17a6e31ae1fb942922c4369aea1 Mon Sep 17 00:00:00 2001
From: "shaver@mozilla.org" <shaver@mozilla.org>
Date: Thu, 24 Apr 2008 13:30:07 -0700
Subject: [PATCH] Bug 430717: fix lookup of incorrect ID when delegating to
 prototype for hole in dense array. r=mrbkap, a=mconnor.

---
 js/src/jsinterp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/js/src/jsinterp.c b/js/src/jsinterp.c
index ec5a0c3ffb28..7c0a44725085 100644
--- a/js/src/jsinterp.c
+++ b/js/src/jsinterp.c
@@ -4532,6 +4532,9 @@ interrupt:
                         rval = obj->dslots[i];
                         if (rval != JSVAL_HOLE)
                             goto end_getelem;
+
+                        /* Reload rval from the stack in the rare hole case. */
+                        rval = FETCH_OPND(-1);
                     }
                 }
                 id = INT_JSVAL_TO_JSID(rval);