1 files changed, 17 insertions, 0 deletions
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 98e740142..a82725ee8 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -32,6 +32,21 @@
 #include "vm/ShapedObject-inl.h"
 #include "vm/TypeInference-inl.h"
 
+namespace js {
+
+// This is needed here for ensureShape() below.
+inline bool
+MaybeConvertUnboxedObjectToNative(ExclusiveContext* cx, JSObject* obj)
+{
+    if (obj->is<UnboxedPlainObject>())
+        return UnboxedPlainObject::convertToNative(cx->asJSContext(), obj);
+    if (obj->is<UnboxedArrayObject>())
+        return UnboxedArrayObject::convertToNative(cx->asJSContext(), obj);
+    return true;
+}
+
+} // namespace js
+
 inline js::Shape*
 JSObject::maybeShape() const
 {
@@ -44,6 +59,8 @@ JSObject::maybeShape() const
 inline js::Shape*
 JSObject::ensureShape(js::ExclusiveContext* cx)
 {
+    if (!js::MaybeConvertUnboxedObjectToNative(cx, this))
+        return nullptr;
     js::Shape* shape = maybeShape();
     MOZ_ASSERT(shape);
     return shape;