Bug 957542 - Set minimum slots of ArrayObject to 2 to fix GGC, r=jandem

js/src/vm/ObjectImpl.cpp

@@ -365,6 +365,8 @@ js::ObjectImpl::dynamicSlotsCount(uint32_t nfixed, uint32_t span, const Class *c
     // this because slots are uncommon in that case.
     if (clasp != &ArrayObject::class_ && span <= SLOT_CAPACITY_MIN)
         return SLOT_CAPACITY_MIN;
+    if (clasp == &ArrayObject::class_ && span <= SLOT_CAPACITY_ARRAYOBJECT_MIN)
+        return SLOT_CAPACITY_ARRAYOBJECT_MIN;
 
     uint32_t slots = mozilla::RoundUpPow2(span);
     MOZ_ASSERT(slots >= span);

js/src/vm/ObjectImpl.h

@@ -1155,6 +1155,7 @@ class ObjectImpl : public gc::BarrieredCell<ObjectImpl>
      * since they normally don't have a lot of slots.
      */
     static const uint32_t SLOT_CAPACITY_MIN = 8;
+    static const uint32_t SLOT_CAPACITY_ARRAYOBJECT_MIN = 2;
 
     HeapSlot *fixedSlots() const {
         return reinterpret_cast<HeapSlot *>(uintptr_t(this) + sizeof(ObjectImpl));