From 2152d1c6781e9d4722a157eb70b53b2783e2ac05 Mon Sep 17 00:00:00 2001
From: "brendan%mozilla.org" <brendan%mozilla.org>
Date: Sun, 14 May 2000 05:38:51 +0000
Subject: [PATCH] Set newborn to root of object tree created by literal
 (followup to waterson nsJSEnvironment.cpp fix).

---
 js/src/jsinterp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/js/src/jsinterp.c b/js/src/jsinterp.c
index 9e2b18708c52..89976e9f152e 100644
--- a/js/src/jsinterp.c
+++ b/js/src/jsinterp.c
@@ -2105,7 +2105,9 @@ js_Interpret(JSContext *cx, jsval *result)
             /* Get immediate argc and find the constructor function. */
             argc = GET_ARGC(pc);
 
+#if JS_HAS_INITIALIZERS
           do_new:
+#endif
             vp = sp - (2 + argc);
             JS_ASSERT(vp >= newsp);
 
@@ -3158,6 +3160,12 @@ js_Interpret(JSContext *cx, jsval *result)
           case JSOP_ENDINIT:
             if (--fp->sharpDepth == 0)
                 fp->sharpArray = NULL;
+
+            /* Re-set the newborn root to the top of this object tree. */
+            JS_ASSERT(sp - newsp >= 1);
+            lval = sp[-1];
+            JS_ASSERT(JSVAL_IS_OBJECT(lval));
+            cx->newborn[GCX_OBJECT] = JSVAL_TO_GCTHING(lval);
             break;
 
           case JSOP_INITPROP: