Bug 1166041 - Add some assertions to help catch leaked slots memory r=terrence

--HG--
extra : rebase_source : a0324e603a1b30673c6d3b28313f807ec7f7f401

js/src/gc/Allocator.cpp

@@ -110,6 +110,8 @@ js::Allocate(ExclusiveContext* cx, AllocKind kind, size_t nDynamicSlots, Initial
     static_assert(sizeof(JSObject_Slots0) >= CellSize,
                   "All allocations must be at least the allocator-imposed minimum size.");
 
+    MOZ_ASSERT_IF(nDynamicSlots != 0, clasp->isNative());
+
     // Off-main-thread alloc cannot trigger GC or make runtime assertions.
     if (!cx->isJSContext())
         return GCRuntime::tryNewTenuredObject<NoGC>(cx, kind, thingSize, nDynamicSlots);

js/src/gc/Nursery.cpp

@@ -197,6 +197,7 @@ js::Nursery::allocateObject(JSContext* cx, size_t size, size_t numDynamic, const
     /* If we want external slots, add them. */
     HeapSlot* slots = nullptr;
     if (numDynamic) {
+        MOZ_ASSERT(clasp->isNative());
         slots = static_cast<HeapSlot*>(allocateBuffer(cx->zone(), numDynamic * sizeof(HeapSlot)));
         if (!slots) {
             /*

js/src/vm/NativeObject.cpp

@@ -333,8 +333,10 @@ NativeObject::setLastPropertyMakeNonNative(Shape* shape)
 
     if (hasDynamicElements())
         js_free(getElementsHeader());
-    if (hasDynamicSlots())
+    if (hasDynamicSlots()) {
         js_free(slots_);
+        slots_ = nullptr;
+    }
 
     shape_ = shape;
 }
@@ -396,6 +398,7 @@ NativeObject::growSlots(ExclusiveContext* cx, uint32_t oldCount, uint32_t newCou
     MOZ_ASSERT(newCount < NELEMENTS_LIMIT);
 
     if (!oldCount) {
+        MOZ_ASSERT(!slots_);
         slots_ = AllocateObjectBuffer<HeapSlot>(cx, this, newCount);
         if (!slots_)
             return false;