[js] Get the class pointer from the ObjectGroup in NativeObject::slotSpan

This changes NativeObject::slotSpan() to get the class from the object group
rather than getting it from the base shape to avoid a race between
Shape::ensureOwnBaseShape and background sweeping.

1 files changed, 4 insertions, 1 deletions

diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h
index 3a3e50244..e9c59ff7c 100644
--- a/js/src/vm/NativeObject.h
+++ b/js/src/vm/NativeObject.h
@@ -646,7 +646,10 @@ class NativeObject : public ShapedObject
     uint32_t slotSpan() const {
         if (inDictionaryMode())
             return lastProperty()->base()->slotSpan();
-        return lastProperty()->slotSpan();
+
+        // Get the class from the object group rather than the base shape to avoid a
+        // race between Shape::ensureOwnBaseShape and background sweeping.
+        return lastProperty()->slotSpan(getClass());
     }
 
     /* Whether a slot is at a fixed offset from this object. */