Bug 1340482 - Trace shape for shaped but non-native objects. r=sfink

--HG--
extra : rebase_source : c21602d9b65c02920c8dc57cf3bce5011d7ed340

js/src/jsobj.cpp

@@ -3879,12 +3879,13 @@ JSObject::traceChildren(JSTracer* trc)
 {
     TraceEdge(trc, &group_, "group");
 
+    if (is<ShapedObject>())
+        as<ShapedObject>().traceShape(trc);
+
     const Class* clasp = group_->clasp();
     if (clasp->isNative()) {
         NativeObject* nobj = &as<NativeObject>();
 
-        TraceEdge(trc, &nobj->shape_, "shape");
-
         {
             GetObjectSlotNameFunctor func(nobj);
             JS::AutoTracingDetails ctx(trc, func);

js/src/vm/ShapedObject.h

@@ -39,6 +39,10 @@ class ShapedObject : public JSObject
 
     Shape* shape() const { return this->shape_; }
 
+    void traceShape(JSTracer* trc) {
+        TraceEdge(trc, &shape_, "shape");
+    }
+
     static size_t offsetOfShape() { return offsetof(ShapedObject, shape_); }
 
   private: