Hacking Mac OS X - Black Hat

Allocation
ArrayInstance::ArrayInstance(JSObject* prototype, unsigned
initialLength)
: JSObject(prototype)
{
unsigned initialCapacity = min(initialLength, sparseArrayCutoff);
m_length = initialLength;
m_vectorLength = initialCapacity;
m_storage =
static_cast(fastZeroedMalloc(storageSize(initialCapaci
ty)));
Collector::reportExtraMemoryCost(initialCapacity *
sizeof(JSValue*));
}