From 902f860ca74b25d746975d0c00f69fd83060f992 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Mon, 20 Mar 2017 18:13:19 -0400
Subject: [PATCH] Bug 1340482 - Trace shape for shaped but non-native objects.
 r=sfink

--HG--
extra : rebase_source : c21602d9b65c02920c8dc57cf3bce5011d7ed340
---
 js/src/jsobj.cpp         | 5 +++--
 js/src/vm/ShapedObject.h | 4 ++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index e3439bad7d19..7820d0295f72 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -3879,12 +3879,13 @@ JSObject::traceChildren(JSTracer* trc)
 {
     TraceEdge(trc, &group_, "group");
 
+    if (is<ShapedObject>())
+        as<ShapedObject>().traceShape(trc);
+
     const Class* clasp = group_->clasp();
     if (clasp->isNative()) {
         NativeObject* nobj = &as<NativeObject>();
 
-        TraceEdge(trc, &nobj->shape_, "shape");
-
         {
             GetObjectSlotNameFunctor func(nobj);
             JS::AutoTracingDetails ctx(trc, func);
diff --git a/js/src/vm/ShapedObject.h b/js/src/vm/ShapedObject.h
index b8b665e9d2ff..408649bd8269 100644
--- a/js/src/vm/ShapedObject.h
+++ b/js/src/vm/ShapedObject.h
@@ -39,6 +39,10 @@ class ShapedObject : public JSObject
 
     Shape* shape() const { return this->shape_; }
 
+    void traceShape(JSTracer* trc) {
+        TraceEdge(trc, &shape_, "shape");
+    }
+
     static size_t offsetOfShape() { return offsetof(ShapedObject, shape_); }
 
   private: