Two things: 1) This is the jsops hook for js_ArrayClass. Is it even possible for obj->isDenseArray() to be false on entry to this function? 2) Given obj->isDenseArray(), I would think that obj->getProto() is guaranteed non-null. Why do we need that null check? In other words, I think the entirety of the function can look like this: if (IsDenseArrayId(cx, obj, id)) { *propp = (JSProperty *) 1; /* non-null to indicate found */ *objp = obj; return JS_TRUE; } return obj->getProto()->lookupProperty(cx, id, objp, propp);

array_lookupProperty was removed in http://hg.mozilla.org/mozilla-central/rev/f4671ccc4502