Merge branch 'redwood' into 28.9-platform

1 files changed, 15 insertions, 4 deletions

diff --git a/js/src/vm/ReceiverGuard.cpp b/js/src/vm/ReceiverGuard.cpp
index e95e8a208..97df908c3 100644
--- a/js/src/vm/ReceiverGuard.cpp
+++ b/js/src/vm/ReceiverGuard.cpp
@@ -7,6 +7,7 @@
 #include "vm/ReceiverGuard.h"
 
 #include "builtin/TypedObject.h"
+#include "vm/UnboxedObject.h"
 #include "jsobjinlines.h"
 
 using namespace js;
@@ -15,7 +16,11 @@ ReceiverGuard::ReceiverGuard(JSObject* obj)
   : group(nullptr), shape(nullptr)
 {
     if (obj) {
-        if (obj->is<TypedObject>()) {
+        if (obj->is<UnboxedPlainObject>()) {
+            group = obj->group();
+            if (UnboxedExpandoObject* expando = obj->as<UnboxedPlainObject>().maybeExpando())
+                shape = expando->lastProperty();
+        } else if (obj->is<UnboxedArrayObject>() || obj->is<TypedObject>()) {
             group = obj->group();
         } else {
             shape = obj->maybeShape();
@@ -28,7 +33,9 @@ ReceiverGuard::ReceiverGuard(ObjectGroup* group, Shape* shape)
 {
     if (group) {
         const Class* clasp = group->clasp();
-        if (IsTypedObjectClass(clasp)) {
+        if (clasp == &UnboxedPlainObject::class_) {
+            // Keep both group and shape.
+        } else if (clasp == &UnboxedArrayObject::class_ || IsTypedObjectClass(clasp)) {
             this->shape = nullptr;
         } else {
             this->group = nullptr;
@@ -39,8 +46,12 @@ ReceiverGuard::ReceiverGuard(ObjectGroup* group, Shape* shape)
 /* static */ int32_t
 HeapReceiverGuard::keyBits(JSObject* obj)
 {
-    if (obj->is<TypedObject>()) {
-        // Only the group needs to be guarded for typed objects.
+    if (obj->is<UnboxedPlainObject>()) {
+        // Both the group and shape need to be guarded for unboxed plain objects.
+        return obj->as<UnboxedPlainObject>().maybeExpando() ? 0 : 1;
+    }
+    if (obj->is<UnboxedArrayObject>() || obj->is<TypedObject>()) {
+        // Only the group needs to be guarded for unboxed arrays and typed objects.
         return 2;
     }
     // Other objects only need the shape to be guarded.