Fix test failures, bug 693479.

js/src/jsgcinlines.h

@@ -101,7 +101,7 @@ GetGCArrayKind(size_t numSlots)
      * unused.
      */
     JS_STATIC_ASSERT(sizeof(ObjectElements) == 2 * sizeof(Value));
-    if (numSlots + 2 >= SLOTS_TO_THING_KIND_LIMIT)
+    if (numSlots > JSObject::NSLOTS_LIMIT || numSlots + 2 >= SLOTS_TO_THING_KIND_LIMIT)
         return FINALIZE_OBJECT2;
     return slotsToThingKind[numSlots + 2];
 }

js/src/jsobj.h

@@ -508,7 +508,7 @@ struct JSObject : js::gc::Cell
     inline js::Shape **addressOfShape() { return &shape_; }
 
     inline js::Shape **nativeSearch(JSContext *cx, jsid id, bool adding = false);
-    inline const js::Shape *nativeLookup(JSContext *cx, jsid id);
+    const js::Shape *nativeLookup(JSContext *cx, jsid id);
 
     inline bool nativeContains(JSContext *cx, jsid id);
     inline bool nativeContains(JSContext *cx, const js::Shape &shape);

js/src/jsobjinlines.h

@@ -1074,7 +1074,7 @@ JSObject::isNative() const
 inline js::Shape **
 JSObject::nativeSearch(JSContext *cx, jsid id, bool adding)
 {
-    return js::Shape::search(cx, lastProperty(), id, adding);
+    return js::Shape::search(cx, &shape_, id, adding);
 }
 
 inline const js::Shape *

js/src/jsscope.h

@@ -509,7 +509,7 @@ struct Shape : public js::gc::Cell
                                    else to obj->lastProp */
     };
 
-    static inline js::Shape **search(JSContext *cx, js::Shape *start, jsid id,
+    static inline js::Shape **search(JSContext *cx, js::Shape **pstart, jsid id,
                                      bool adding = false);
     static js::Shape *newDictionaryList(JSContext *cx, js::Shape **listp);
 
@@ -896,8 +896,9 @@ struct EmptyShape : public js::Shape
 namespace js {
 
 JS_ALWAYS_INLINE js::Shape **
-Shape::search(JSContext *cx, js::Shape *start, jsid id, bool adding)
+Shape::search(JSContext *cx, js::Shape **pstart, jsid id, bool adding)
 {
+    Shape *start = *pstart;
     if (start->hasTable())
         return start->table().search(id, adding);
 
@@ -920,7 +921,7 @@ Shape::search(JSContext *cx, js::Shape *start, jsid id, bool adding)
      * load and id test at the end (when missing).
      */
     js::Shape **spp;
-    for (spp = &start; js::Shape *shape = *spp; spp = &shape->parent) {
+    for (spp = pstart; js::Shape *shape = *spp; spp = &shape->parent) {
         if (shape->maybePropid() == id)
             return spp;
     }

js/src/jsscript.cpp

@@ -89,7 +89,7 @@ Bindings::lookup(JSContext *cx, JSAtom *name, uintN *indexp) const
         return NONE;
 
     Shape *shape =
-        SHAPE_FETCH(Shape::search(cx, lastBinding, ATOM_TO_JSID(name)));
+        SHAPE_FETCH(Shape::search(cx, const_cast<Shape **>(&lastBinding), ATOM_TO_JSID(name)));
     if (!shape)
         return NONE;
 

js/src/shell/js.cpp

@@ -1913,7 +1913,7 @@ SrcNotes(JSContext *cx, JSScript *script, Sprinter *sp)
           case SRC_FUNCDEF: {
             index = js_GetSrcNoteOffset(sn, 0);
             JSObject *obj = script->getObject(index);
-            JSFunction *fun = (JSFunction *) JS_GetPrivate(cx, obj);
+            JSFunction *fun = obj->toFunction();
             str = JS_DecompileFunction(cx, fun, JS_DONT_PRETTY_PRINT);
             JSAutoByteString bytes;
             if (!str || !bytes.encode(cx, str))

js/src/vm/CallObject.cpp

@@ -66,8 +66,8 @@ CallObject::create(JSContext *cx, JSScript *script, JSObject &scopeChain, JSObje
      * call object's frame has finished.
      */
     if (cx->typeInferenceEnabled() && gc::GetGCKindSlots(kind) < slots) {
-        kind = gc::GetGCObjectKind(RESERVED_SLOTS);
-        JS_ASSERT(gc::GetGCKindSlots(kind) == RESERVED_SLOTS);
+        kind = gc::GetGCObjectKind(RESERVED_SLOTS + 1);
+        JS_ASSERT(gc::GetGCKindSlots(kind) == RESERVED_SLOTS + 1);
     }
 
     JSObject *obj = js_NewGCObject(cx, kind);

js/src/vm/CallObject.h

@@ -64,7 +64,7 @@ public:
     static CallObject *
     create(JSContext *cx, JSScript *script, JSObject &scopeChain, JSObject *callee);
 
-    static const uint32 RESERVED_SLOTS = 2;
+    static const uint32 RESERVED_SLOTS = 3;
 
     /* True if this is for a strict mode eval frame or for a function call. */
     inline bool isForEval() const;