From 636412d09044b9fd6f7cc5d8957592569ed560c9 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 3 Aug 2015 14:02:23 -0700
Subject: [PATCH] Bug 1182865 - Relax assertion on the allowed class for home
 objects, r=efaust

---
 js/src/jit-test/tests/basic/bug1182865.js | 8 ++++++++
 js/src/vm/Interpreter.cpp                 | 6 +++---
 2 files changed, 11 insertions(+), 3 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/bug1182865.js

diff --git a/js/src/jit-test/tests/basic/bug1182865.js b/js/src/jit-test/tests/basic/bug1182865.js
new file mode 100644
index 000000000000..f221b4328ca5
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1182865.js
@@ -0,0 +1,8 @@
+
+for (var j = 0; j < 99; j++) {
+    Array[{
+        f() {
+            eval()
+        }
+    }];
+}
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 37bbb7ff52b0..9a8c4882c37a 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -4040,9 +4040,9 @@ CASE(JSOP_INITHOMEOBJECT)
     MOZ_ASSERT(func->allowSuperProperty());
 
     /* Load the home object */
-    ReservedRooted<NativeObject*> obj(&rootNativeObject0);
-    obj = &REGS.sp[int(-2 - skipOver)].toObject().as<NativeObject>();
-    MOZ_ASSERT(obj->is<PlainObject>() || obj->is<JSFunction>());
+    ReservedRooted<JSObject*> obj(&rootObject0);
+    obj = &REGS.sp[int(-2 - skipOver)].toObject();
+    MOZ_ASSERT(obj->is<PlainObject>() || obj->is<UnboxedPlainObject>() || obj->is<JSFunction>());
 
     func->setExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT, ObjectValue(*obj));
 }