b=570025; don't use JS_ConstructObjectWithArguments in typed arrays; r=gal

js/src/jstypedarray.cpp

@@ -1185,11 +1185,12 @@ class TypedArrayTemplate
         }
 
         jsval argv = INT_TO_JSVAL(bytes);
-        JSObject *obj = JS_ConstructObjectWithArguments(cx, &ArrayBuffer::jsclass, NULL, NULL,
-                                                        1, &argv);
-        if (!obj)
+        AutoValueRooter tvr(cx);
+        if (!ArrayBuffer::create(cx, NULL, 1, &argv, tvr.addr()))
             return false;
 
+        JSObject *obj = JSVAL_TO_OBJECT(tvr.value());
+
         bufferJS = obj;
         buffer = ArrayBuffer::fromJSObject(obj);