From a2b70a9f5583faa913f827c75533cb25e4c4389e Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 6 Feb 2018 11:53:21 +0000
Subject: [PATCH] Bug 1435295 - Don't attempt to mark object group unknown
 unnecessarily when merging compartments r=jandem

---
 js/src/jit-test/tests/gc/bug-1435295.js | 11 +++++++++++
 js/src/jsgc.cpp                         |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-1435295.js

diff --git a/js/src/jit-test/tests/gc/bug-1435295.js b/js/src/jit-test/tests/gc/bug-1435295.js
new file mode 100644
index 000000000000..adb4e2f432ee
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1435295.js
@@ -0,0 +1,11 @@
+if (helperThreadCount() === 0)
+    quit();
+if (!('oomTest' in this))
+    quit();
+
+oomTest(new Function(`function execOffThread(source) {
+    offThreadCompileModule(source);
+    return finishOffThreadModule();
+}
+b = execOffThread("[1, 2, 3]")
+`));
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 81b6d8774649..5bcae32fdf7a 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -7934,7 +7934,7 @@ GCRuntime::mergeCompartments(JSCompartment* source, JSCompartment* target)
                 JSObject* targetProto = global->getPrototypeForOffThreadPlaceholder(obj);
                 MOZ_ASSERT(targetProto->isDelegate());
                 group->setProtoUnchecked(TaggedProto(targetProto));
-                if (targetProto->isNewGroupUnknown())
+                if (targetProto->isNewGroupUnknown() && !group->unknownProperties())
                     group->markUnknown(cx);
             }
         }