Bug 1204165 - Fix typo when concatenating arrays with different unboxed layouts, r=jandem.

js/src/jit-test/tests/ion/bug1204165.js

@@ -0,0 +1,10 @@
+var x;
+function f() {
+    x = [];
+    for (var i = 0; i < 1; ++i) {
+        x.push("");
+    }
+    [0].concat(x);
+}
+f();
+f();

js/src/vm/UnboxedObject-inl.h

@@ -571,7 +571,7 @@ CopyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* dst, JSObject* src,
     MOZ_ASSERT(HasBoxedOrUnboxedDenseElements<SrcType>(src));
     MOZ_ASSERT(HasBoxedOrUnboxedDenseElements<DstType>(dst));
     MOZ_ASSERT(GetBoxedOrUnboxedInitializedLength<DstType>(dst) == dstStart);
-    MOZ_ASSERT(GetBoxedOrUnboxedInitializedLength<DstType>(src) >= srcStart + length);
+    MOZ_ASSERT(GetBoxedOrUnboxedInitializedLength<SrcType>(src) >= srcStart + length);
     MOZ_ASSERT(GetBoxedOrUnboxedCapacity<DstType>(dst) >= dstStart + length);
 
     SetBoxedOrUnboxedInitializedLength<DstType>(cx, dst, dstStart + length);