1 files changed, 27 insertions, 0 deletions
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
index d801fad06..bd7484e07 100644
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -388,6 +388,33 @@ NativeObject::setLastPropertyMakeNonNative(Shape* shape)
     shape_ = shape;
 }
 
+void
+NativeObject::setLastPropertyMakeNative(ExclusiveContext* cx, Shape* shape)
+{
+    MOZ_ASSERT(getClass()->isNative());
+    MOZ_ASSERT(shape->getObjectClass()->isNative());
+    MOZ_ASSERT(!shape->inDictionary());
+
+    // This method is used to convert unboxed objects into native objects. In
+    // this case, the shape_ field was previously used to store other data and
+    // this should be treated as an initialization.
+    shape_.init(shape);
+
+    slots_ = nullptr;
+    elements_ = emptyObjectElements;
+
+    size_t oldSpan = shape->numFixedSlots();
+    size_t newSpan = shape->slotSpan();
+
+    initializeSlotRange(0, oldSpan);
+
+    // A failure at this point will leave the object as a mutant, and we
+    // can't recover.
+    AutoEnterOOMUnsafeRegion oomUnsafe;
+    if (oldSpan != newSpan && !updateSlotsForSpan(cx, oldSpan, newSpan))
+        oomUnsafe.crash("NativeObject::setLastPropertyMakeNative");
+}
+
 bool
 NativeObject::setSlotSpan(ExclusiveContext* cx, uint32_t span)
 {