From 4941565e3d40f20e562e9de22ac66585965f0110 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 15 Oct 2015 15:45:51 -0700
Subject: [PATCH] Bug 1215337 - Cache slotSpan(), r=terrence

--HG--
extra : rebase_source : 30a1fa3398af0bf1aade4e1d7da469aa2aaf95ac
---
 js/src/jsobj.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 13a741da699d..53c008b18552 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -3713,11 +3713,15 @@ JSObject::traceChildren(JSTracer* trc)
             GetObjectSlotNameFunctor func(nobj);
             JS::AutoTracingDetails ctx(trc, func);
             JS::AutoTracingIndex index(trc);
-            for (uint32_t i = 0; i < nobj->slotSpan(); ++i) {
+            // Tracing can mutate the target but cannot change the slot count,
+            // but the compiler has no way of knowing this.
+            const uint32_t nslots = nobj->slotSpan();
+            for (uint32_t i = 0; i < nslots; ++i) {
                 TraceManuallyBarrieredEdge(trc, nobj->getSlotRef(i).unsafeUnbarrieredForTracing(),
                                            "object slot");
                 ++index;
             }
+            MOZ_ASSERT(nslots == nobj->slotSpan());
         }
 
         do {