Bug 1140888 - Make sure Ion code depending on unboxed layouts is invalidated when unboxed objects are converted to natives, r=jandem.

js/src/jit-test/tests/ion/unboxed-objects-invalidate.js

@@ -0,0 +1,16 @@
+
+var a = [];
+for (var i = 0; i < 2000; i++)
+    a.push({f:i});
+
+function f() {
+    var total = 0;
+    for (var i = 0; i < a.length; i++)
+        total += a[i].f;
+    return total;
+}
+assertEq(f(), 1999000);
+
+var sub = Object.create(a[0]);
+
+assertEq(f(), 1999000);

js/src/vm/UnboxedObject.cpp

@@ -265,6 +265,8 @@ UnboxedLayout::makeNativeGroup(JSContext *cx, ObjectGroup *group)
 
     nativeGroup->setOriginalUnboxedGroup(group);
 
+    group->markStateChange(cx);
+
     return true;
 }