diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp index 521afff36ba1..55ff807efb8a 100644 --- a/js/src/vm/TypedArrayObject.cpp +++ b/js/src/vm/TypedArrayObject.cpp @@ -1341,14 +1341,15 @@ ArrayBufferViewObject::trace(JSTracer *trc, JSObject *obj) HeapSlot &bufSlot = obj->getReservedSlotRef(BUFFER_SLOT); MarkSlot(trc, &bufSlot, "typedarray.buffer"); - /* Update obj's data slot if the array buffer moved. */ + /* Update obj's data slot if the array buffer moved. Note that during + * initialization, bufSlot may still be JSVAL_VOID. */ if (bufSlot.isObject()) { ArrayBufferObject &buf = bufSlot.toObject().as(); int32_t offset = obj->getReservedSlot(BYTEOFFSET_SLOT).toInt32(); obj->initPrivate(buf.dataPointer() + offset); } - /* Update NEXT_VEIW_SLOT, if the view moved. */ + /* Update NEXT_VIEW_SLOT, if the view moved. */ IsSlotMarked(&obj->getReservedSlotRef(NEXT_VIEW_SLOT)); }