From 2d907f3406905fc3cc55eb56ab7bff9d815fc3d1 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 17 Jun 2015 11:02:52 +0200
Subject: [PATCH] Backed out changeset 822901f56c1f (bug 1170216)

--HG--
extra : rebase_source : fcde858b7a057af0a53b9e4e00bea770a38bc3a1
---
 js/src/jsobj.cpp | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 8d546c8ebc67..bb50c022e463 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -548,19 +548,6 @@ js::SetIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level)
 
         MOZ_ASSERT(nobj->lastProperty()->slotSpan() == last->slotSpan());
         JS_ALWAYS_TRUE(nobj->setLastProperty(cx, last));
-
-        // Ordinarily ArraySetLength handles this, but we're going behind its back
-        // right now, so we must do this manually.
-        //
-        // ArraySetLength also implements the capacity <= length invariant for
-        // arrays with non-writable length.  We don't need to do anything special
-        // for that, because capacity was zeroed out by preventExtensions.  (See
-        // the assertion about getDenseCapacity above.)
-        if (level == IntegrityLevel::Frozen && obj->is<ArrayObject>()) {
-            if (!obj->as<ArrayObject>().maybeCopyElementsForWrite(cx))
-                return false;
-            obj->as<ArrayObject>().getElementsHeader()->setNonwritableArrayLength();
-        }
     } else {
         RootedId id(cx);
         Rooted<PropertyDescriptor> desc(cx);
@@ -599,6 +586,21 @@ js::SetIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level)
         }
     }
 
+    // Ordinarily ArraySetLength handles this, but we're going behind its back
+    // right now, so we must do this manually.  Neither the custom property
+    // tree mutations nor the DefineProperty call in the above code will do
+    // this for us.
+    //
+    // ArraySetLength also implements the capacity <= length invariant for
+    // arrays with non-writable length.  We don't need to do anything special
+    // for that, because capacity was zeroed out by preventExtensions.  (See
+    // the assertion before the if-else above.)
+    if (level == IntegrityLevel::Frozen && obj->is<ArrayObject>()) {
+        if (!obj->as<ArrayObject>().maybeCopyElementsForWrite(cx))
+            return false;
+        obj->as<ArrayObject>().getElementsHeader()->setNonwritableArrayLength();
+    }
+
     return true;
 }