diff --git a/js/src/jsobj.c b/js/src/jsobj.c index 303d24ba1add..7b6c321ef733 100644 --- a/js/src/jsobj.c +++ b/js/src/jsobj.c @@ -2944,6 +2944,8 @@ js_FreeSlot(JSContext *cx, JSObject *obj, uint32 slot) JS_ASSERT(!MAP_IS_NATIVE(map) || ((JSScope *)map)->object == obj); LOCKED_OBJ_SET_SLOT(obj, slot, JSVAL_VOID); if (map->freeslot == slot + 1) { + map->freeslot = slot; + /* When shrinking ReallocSlots always returns true. */ ReallocSlots(cx, obj, slot, JS_FALSE); }