Bug 1077041 - NativeObject::copy, Only copy the minimum between the number of fixed slot and the span of the shape. r=jandem
--- a/js/src/vm/ObjectImpl-inl.h
+++ b/js/src/vm/ObjectImpl-inl.h
@@ -323,17 +323,20 @@ NativeObject::copy(ExclusiveContext *cx,
if (!baseObj)
return nullptr;
NativeObject *obj = &baseObj->as<NativeObject>();
size_t span = shape->slotSpan();
if (span) {
uint32_t numFixed = templateObject->numFixedSlots();
const Value *fixed = &templateObject->getSlot(0);
- MOZ_ASSERT(numFixed <= span);
+ // Only copy elements which are registered in the shape, even if the
+ // number of fixed slots is larger.
+ if (span < numFixed)
+ numFixed = span;
obj->copySlotRange(0, fixed, numFixed);
if (numFixed < span) {
uint32_t numSlots = span - numFixed;
const Value *slots = &templateObject->getSlot(numFixed);
obj->copySlotRange(numFixed, slots, numSlots);
}
}