Bug 1310744: Allow MoveBoxedOrUnboxedDenseElements to bail out if the elements are frozen. r=nbp

MozReview-Commit-ID: EXhw8FkcNnu

--HG--
extra : rebase_source : 157628abbb16c618e9f451381510813b5535fb00

js/src/jsarray.cpp

@@ -2203,9 +2203,8 @@ ArrayShiftDenseKernel(JSContext* cx, HandleObject obj, MutableHandleValue rval)
         rval.setUndefined();
 
     DenseElementResult result = MoveBoxedOrUnboxedDenseElements<Type>(cx, obj, 0, 1, initlen - 1);
-    MOZ_ASSERT(result != DenseElementResult::Incomplete);
+    if (result != DenseElementResult::Success)
-    if (result == DenseElementResult::Failure)
+        return result;
-        return DenseElementResult::Failure;
 
     SetBoxedOrUnboxedInitializedLength<Type>(cx, obj, initlen - 1);
     return DenseElementResult::Success;

js/src/vm/UnboxedObject-inl.h

@@ -561,6 +561,9 @@ MoveBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj, uint32_t dstStart,
     MOZ_ASSERT(HasBoxedOrUnboxedDenseElements<Type>(obj));
 
     if (Type == JSVAL_TYPE_MAGIC) {
+        if (obj->as<NativeObject>().denseElementsAreFrozen())
+            return DenseElementResult::Incomplete;
+
         if (!obj->as<NativeObject>().maybeCopyElementsForWrite(cx))
             return DenseElementResult::Failure;
         obj->as<NativeObject>().moveDenseElements(dstStart, srcStart, length);