It's an optional out parameter that receives the JSProperty pointer. A glance at all the call sites reveals everyone's passing null except for one in the interpreter, in CASE(JSOP_DEFVAR). That one could be changed to call js_DefineNativeProperty directly, if it's true that fp->varobj is always a native object (with the normal native defineProperty op). array_defineProperty ignores this out parameter, leaving it uninitialized. If we were using it, I think array_dropProperty would be asserting.

Comment on attachment 396616 [details] [diff] [review] v1 Drive by r=me! /be

Brendan grabbed it as I was reviewing. No objections here either.

Comment on attachment 396616 [details] [diff] [review] v1 http://hg.mozilla.org/tracemonkey/rev/369b7fbc2304