Add m-esr52 at 52.6.0

1 files changed, 1552 insertions, 0 deletions

diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h
new file mode 100644
index 0000000000..d2c06eabc1
--- /dev/null
+++ b/js/src/vm/NativeObject.h
@@ -0,0 +1,1552 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef vm_NativeObject_h
+#define vm_NativeObject_h
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Attributes.h"
+
+#include <stdint.h>
+
+#include "jsfriendapi.h"
+#include "jsobj.h"
+#include "NamespaceImports.h"
+
+#include "gc/Barrier.h"
+#include "gc/Heap.h"
+#include "gc/Marking.h"
+#include "js/Value.h"
+#include "vm/Shape.h"
+#include "vm/ShapedObject.h"
+#include "vm/String.h"
+#include "vm/TypeInference.h"
+
+namespace js {
+
+class Shape;
+class TenuringTracer;
+
+/*
+ * To really poison a set of values, using 'magic' or 'undefined' isn't good
+ * enough since often these will just be ignored by buggy code (see bug 629974)
+ * in debug builds and crash in release builds. Instead, we use a safe-for-crash
+ * pointer.
+ */
+static MOZ_ALWAYS_INLINE void
+Debug_SetValueRangeToCrashOnTouch(Value* beg, Value* end)
+{
+#ifdef DEBUG
+    for (Value* v = beg; v != end; ++v)
+        v->setObject(*reinterpret_cast<JSObject*>(0x48));
+#endif
+}
+
+static MOZ_ALWAYS_INLINE void
+Debug_SetValueRangeToCrashOnTouch(Value* vec, size_t len)
+{
+#ifdef DEBUG
+    Debug_SetValueRangeToCrashOnTouch(vec, vec + len);
+#endif
+}
+
+static MOZ_ALWAYS_INLINE void
+Debug_SetValueRangeToCrashOnTouch(GCPtrValue* vec, size_t len)
+{
+#ifdef DEBUG
+    Debug_SetValueRangeToCrashOnTouch((Value*) vec, len);
+#endif
+}
+
+static MOZ_ALWAYS_INLINE void
+Debug_SetSlotRangeToCrashOnTouch(HeapSlot* vec, uint32_t len)
+{
+#ifdef DEBUG
+    Debug_SetValueRangeToCrashOnTouch((Value*) vec, len);
+#endif
+}
+
+static MOZ_ALWAYS_INLINE void
+Debug_SetSlotRangeToCrashOnTouch(HeapSlot* begin, HeapSlot* end)
+{
+#ifdef DEBUG
+    Debug_SetValueRangeToCrashOnTouch((Value*) begin, end - begin);
+#endif
+}
+
+class ArrayObject;
+
+/*
+ * ES6 20130308 draft 8.4.2.4 ArraySetLength.
+ *
+ * |id| must be "length", |attrs| are the attributes to be used for the newly-
+ * changed length property, |value| is the value for the new length, and
+ * |result| receives an error code if the change is invalid.
+ */
+extern bool
+ArraySetLength(JSContext* cx, Handle<ArrayObject*> obj, HandleId id,
+               unsigned attrs, HandleValue value, ObjectOpResult& result);
+
+/*
+ * Elements header used for native objects. The elements component of such objects
+ * offers an efficient representation for all or some of the indexed properties
+ * of the object, using a flat array of Values rather than a shape hierarchy
+ * stored in the object's slots. This structure is immediately followed by an
+ * array of elements, with the elements member in an object pointing to the
+ * beginning of that array (the end of this structure).
+ * See below for usage of this structure.
+ *
+ * The sets of properties represented by an object's elements and slots
+ * are disjoint. The elements contain only indexed properties, while the slots
+ * can contain both named and indexed properties; any indexes in the slots are
+ * distinct from those in the elements. If isIndexed() is false for an object,
+ * all indexed properties (if any) are stored in the dense elements.
+ *
+ * Indexes will be stored in the object's slots instead of its elements in
+ * the following case:
+ *  - there are more than MIN_SPARSE_INDEX slots total and the load factor
+ *    (COUNT / capacity) is less than 0.25
+ *  - a property is defined that has non-default property attributes.
+ *
+ * We track these pieces of metadata for dense elements:
+ *  - The length property as a uint32_t, accessible for array objects with
+ *    ArrayObject::{length,setLength}().  This is unused for non-arrays.
+ *  - The number of element slots (capacity), gettable with
+ *    getDenseCapacity().
+ *  - The array's initialized length, accessible with
+ *    getDenseInitializedLength().
+ *
+ * Holes in the array are represented by MagicValue(JS_ELEMENTS_HOLE) values.
+ * These indicate indexes which are not dense properties of the array. The
+ * property may, however, be held by the object's properties.
+ *
+ * The capacity and length of an object's elements are almost entirely
+ * unrelated!  In general the length may be greater than, less than, or equal
+ * to the capacity.  The first case occurs with |new Array(100)|.  The length
+ * is 100, but the capacity remains 0 (indices below length and above capacity
+ * must be treated as holes) until elements between capacity and length are
+ * set.  The other two cases are common, depending upon the number of elements
+ * in an array and the underlying allocator used for element storage.
+ *
+ * The only case in which the capacity and length of an object's elements are
+ * related is when the object is an array with non-writable length.  In this
+ * case the capacity is always less than or equal to the length.  This permits
+ * JIT code to optimize away the check for non-writable length when assigning
+ * to possibly out-of-range elements: such code already has to check for
+ * |index < capacity|, and fallback code checks for non-writable length.
+ *
+ * The initialized length of an object specifies the number of elements that
+ * have been initialized. All elements above the initialized length are
+ * holes in the object, and the memory for all elements between the initialized
+ * length and capacity is left uninitialized. The initialized length is some
+ * value less than or equal to both the object's length and the object's
+ * capacity.
+ *
+ * There is flexibility in exactly the value the initialized length must hold,
+ * e.g. if an array has length 5, capacity 10, completely empty, it is valid
+ * for the initialized length to be any value between zero and 5, as long as
+ * the in memory values below the initialized length have been initialized with
+ * a hole value. However, in such cases we want to keep the initialized length
+ * as small as possible: if the object is known to have no hole values below
+ * its initialized length, then it is "packed" and can be accessed much faster
+ * by JIT code.
+ *
+ * Elements do not track property creation order, so enumerating the elements
+ * of an object does not necessarily visit indexes in the order they were
+ * created.
+ */
+class ObjectElements
+{
+  public:
+    enum Flags: uint32_t {
+        // Integers written to these elements must be converted to doubles.
+        CONVERT_DOUBLE_ELEMENTS     = 0x1,
+
+        // Present only if these elements correspond to an array with
+        // non-writable length; never present for non-arrays.
+        NONWRITABLE_ARRAY_LENGTH    = 0x2,
+
+        // These elements are shared with another object and must be copied
+        // before they can be changed. A pointer to the original owner of the
+        // elements, which is immutable, is stored immediately after the
+        // elements data. There is one case where elements can be written to
+        // before being copied: when setting the CONVERT_DOUBLE_ELEMENTS flag
+        // the shared elements may change (from ints to doubles) without
+        // making a copy first.
+        COPY_ON_WRITE               = 0x4,
+
+        // For TypedArrays only: this TypedArray's storage is mapping shared
+        // memory.  This is a static property of the TypedArray, set when it
+        // is created and never changed.
+        SHARED_MEMORY               = 0x8,
+
+        // These elements are set to integrity level "frozen".
+        FROZEN                      = 0x10,
+    };
+
+  private:
+    friend class ::JSObject;
+    friend class ArrayObject;
+    friend class NativeObject;
+    friend class TenuringTracer;
+
+    friend bool js::SetIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level);
+
+    friend bool
+    ArraySetLength(JSContext* cx, Handle<ArrayObject*> obj, HandleId id,
+                   unsigned attrs, HandleValue value, ObjectOpResult& result);
+
+    /* See Flags enum above. */
+    uint32_t flags;
+
+    /*
+     * Number of initialized elements. This is <= the capacity, and for arrays
+     * is <= the length. Memory for elements above the initialized length is
+     * uninitialized, but values between the initialized length and the proper
+     * length are conceptually holes.
+     */
+    uint32_t initializedLength;
+
+    /* Number of allocated slots. */
+    uint32_t capacity;
+
+    /* 'length' property of array objects, unused for other objects. */
+    uint32_t length;
+
+    bool shouldConvertDoubleElements() const {
+        return flags & CONVERT_DOUBLE_ELEMENTS;
+    }
+    void setShouldConvertDoubleElements() {
+        // Note: allow isCopyOnWrite() here, see comment above.
+        flags |= CONVERT_DOUBLE_ELEMENTS;
+    }
+    void clearShouldConvertDoubleElements() {
+        MOZ_ASSERT(!isCopyOnWrite());
+        flags &= ~CONVERT_DOUBLE_ELEMENTS;
+    }
+    bool hasNonwritableArrayLength() const {
+        return flags & NONWRITABLE_ARRAY_LENGTH;
+    }
+    void setNonwritableArrayLength() {
+        MOZ_ASSERT(!isCopyOnWrite());
+        flags |= NONWRITABLE_ARRAY_LENGTH;
+    }
+    bool isCopyOnWrite() const {
+        return flags & COPY_ON_WRITE;
+    }
+    void clearCopyOnWrite() {
+        MOZ_ASSERT(isCopyOnWrite());
+        flags &= ~COPY_ON_WRITE;
+    }
+
+  public:
+    constexpr ObjectElements(uint32_t capacity, uint32_t length)
+      : flags(0), initializedLength(0), capacity(capacity), length(length)
+    {}
+
+    enum class SharedMemory {
+        IsShared
+    };
+
+    constexpr ObjectElements(uint32_t capacity, uint32_t length, SharedMemory shmem)
+      : flags(SHARED_MEMORY), initializedLength(0), capacity(capacity), length(length)
+    {}
+
+    HeapSlot* elements() {
+        return reinterpret_cast<HeapSlot*>(uintptr_t(this) + sizeof(ObjectElements));
+    }
+    const HeapSlot* elements() const {
+        return reinterpret_cast<const HeapSlot*>(uintptr_t(this) + sizeof(ObjectElements));
+    }
+    static ObjectElements * fromElements(HeapSlot* elems) {
+        return reinterpret_cast<ObjectElements*>(uintptr_t(elems) - sizeof(ObjectElements));
+    }
+
+    bool isSharedMemory() const {
+        return flags & SHARED_MEMORY;
+    }
+
+    GCPtrNativeObject& ownerObject() const {
+        MOZ_ASSERT(isCopyOnWrite());
+        return *(GCPtrNativeObject*)(&elements()[initializedLength]);
+    }
+
+    static int offsetOfFlags() {
+        return int(offsetof(ObjectElements, flags)) - int(sizeof(ObjectElements));
+    }
+    static int offsetOfInitializedLength() {
+        return int(offsetof(ObjectElements, initializedLength)) - int(sizeof(ObjectElements));
+    }
+    static int offsetOfCapacity() {
+        return int(offsetof(ObjectElements, capacity)) - int(sizeof(ObjectElements));
+    }
+    static int offsetOfLength() {
+        return int(offsetof(ObjectElements, length)) - int(sizeof(ObjectElements));
+    }
+
+    static bool ConvertElementsToDoubles(JSContext* cx, uintptr_t elements);
+    static bool MakeElementsCopyOnWrite(ExclusiveContext* cx, NativeObject* obj);
+    static bool FreezeElements(ExclusiveContext* cx, HandleNativeObject obj);
+
+    bool isFrozen() const {
+        return flags & FROZEN;
+    }
+    void freeze() {
+        MOZ_ASSERT(!isFrozen());
+        MOZ_ASSERT(!isCopyOnWrite());
+        flags |= FROZEN;
+    }
+    void markNotFrozen() {
+        MOZ_ASSERT(isFrozen());
+        MOZ_ASSERT(!isCopyOnWrite());
+        flags &= ~FROZEN;
+    }
+
+    uint8_t elementAttributes() const {
+        if (isFrozen())
+            return JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY;
+        return JSPROP_ENUMERATE;
+    }
+
+    // This is enough slots to store an object of this class. See the static
+    // assertion below.
+    static const size_t VALUES_PER_HEADER = 2;
+};
+
+static_assert(ObjectElements::VALUES_PER_HEADER * sizeof(HeapSlot) == sizeof(ObjectElements),
+              "ObjectElements doesn't fit in the given number of slots");
+
+/*
+ * Shared singletons for objects with no elements.
+ * emptyObjectElementsShared is used only for TypedArrays, when the TA
+ * maps shared memory.
+ */
+extern HeapSlot* const emptyObjectElements;
+extern HeapSlot* const emptyObjectElementsShared;
+
+struct Class;
+class GCMarker;
+class Shape;
+
+class NewObjectCache;
+
+#ifdef DEBUG
+static inline bool
+IsObjectValueInCompartment(const Value& v, JSCompartment* comp);
+#endif
+
+// Operations which change an object's dense elements can either succeed, fail,
+// or be unable to complete. For native objects, the latter is used when the
+// object's elements must become sparse instead. The enum below is used for
+// such operations, and for similar operations on unboxed arrays and methods
+// that work on both kinds of objects.
+enum class DenseElementResult {
+    Failure,
+    Success,
+    Incomplete
+};
+
+/*
+ * NativeObject specifies the internal implementation of a native object.
+ *
+ * Native objects use ShapedObject::shape_ to record property information.  Two
+ * native objects with the same shape are guaranteed to have the same number of
+ * fixed slots.
+ *
+ * Native objects extend the base implementation of an object with storage for
+ * the object's named properties and indexed elements.
+ *
+ * These are stored separately from one another. Objects are followed by a
+ * variable-sized array of values for inline storage, which may be used by
+ * either properties of native objects (fixed slots), by elements (fixed
+ * elements), or by other data for certain kinds of objects, such as
+ * ArrayBufferObjects and TypedArrayObjects.
+ *
+ * Named property storage can be split between fixed slots and a dynamically
+ * allocated array (the slots member). For an object with N fixed slots, shapes
+ * with slots [0..N-1] are stored in the fixed slots, and the remainder are
+ * stored in the dynamic array. If all properties fit in the fixed slots, the
+ * 'slots_' member is nullptr.
+ *
+ * Elements are indexed via the 'elements_' member. This member can point to
+ * either the shared emptyObjectElements and emptyObjectElementsShared singletons,
+ * into the inline value array (the address of the third value, to leave room
+ * for a ObjectElements header;in this case numFixedSlots() is zero) or to
+ * a dynamically allocated array.
+ *
+ * Slots and elements may both be non-empty. The slots may be either names or
+ * indexes; no indexed property will be in both the slots and elements.
+ */
+class NativeObject : public ShapedObject
+{
+  protected:
+    /* Slots for object properties. */
+    js::HeapSlot* slots_;
+
+    /* Slots for object dense elements. */
+    js::HeapSlot* elements_;
+
+    friend class ::JSObject;
+
+  private:
+    static void staticAsserts() {
+        static_assert(sizeof(NativeObject) == sizeof(JSObject_Slots0),
+                      "native object size must match GC thing size");
+        static_assert(sizeof(NativeObject) == sizeof(shadow::Object),
+                      "shadow interface must match actual implementation");
+        static_assert(sizeof(NativeObject) % sizeof(Value) == 0,
+                      "fixed slots after an object must be aligned");
+
+        static_assert(offsetof(NativeObject, group_) == offsetof(shadow::Object, group),
+                      "shadow type must match actual type");
+        static_assert(offsetof(NativeObject, slots_) == offsetof(shadow::Object, slots),
+                      "shadow slots must match actual slots");
+        static_assert(offsetof(NativeObject, elements_) == offsetof(shadow::Object, _1),
+                      "shadow placeholder must match actual elements");
+
+        static_assert(MAX_FIXED_SLOTS <= Shape::FIXED_SLOTS_MAX,
+                      "verify numFixedSlots() bitfield is big enough");
+        static_assert(sizeof(NativeObject) + MAX_FIXED_SLOTS * sizeof(Value) == JSObject::MAX_BYTE_SIZE,
+                      "inconsistent maximum object size");
+    }
+
+  public:
+    Shape* lastProperty() const {
+        MOZ_ASSERT(shape_);
+        return shape_;
+    }
+
+    uint32_t propertyCount() const {
+        return lastProperty()->entryCount();
+    }
+
+    bool hasShapeTable() const {
+        return lastProperty()->hasTable();
+    }
+
+    HeapSlotArray getDenseElements() {
+        return HeapSlotArray(elements_, !getElementsHeader()->isCopyOnWrite());
+    }
+    HeapSlotArray getDenseElementsAllowCopyOnWrite() {
+        // Backdoor allowing direct access to copy on write elements.
+        return HeapSlotArray(elements_, true);
+    }
+    const Value& getDenseElement(uint32_t idx) const {
+        MOZ_ASSERT(idx < getDenseInitializedLength());
+        return elements_[idx];
+    }
+    bool containsDenseElement(uint32_t idx) {
+        return idx < getDenseInitializedLength() && !elements_[idx].isMagic(JS_ELEMENTS_HOLE);
+    }
+    uint32_t getDenseInitializedLength() const {
+        return getElementsHeader()->initializedLength;
+    }
+    uint32_t getDenseCapacity() const {
+        return getElementsHeader()->capacity;
+    }
+
+    bool isSharedMemory() const {
+        return getElementsHeader()->isSharedMemory();
+    }
+
+    // Update the last property, keeping the number of allocated slots in sync
+    // with the object's new slot span.
+    bool setLastProperty(ExclusiveContext* cx, Shape* shape);
+
+    // As for setLastProperty(), but allows the number of fixed slots to
+    // change. This can only be used when fixed slots are being erased from the
+    // object, and only when the object will not require dynamic slots to cover
+    // the new properties.
+    void setLastPropertyShrinkFixedSlots(Shape* shape);
+
+    // As for setLastProperty(), but changes the class associated with the
+    // object to a non-native one. This leaves the object with a type and shape
+    // that are (temporarily) inconsistent.
+    void setLastPropertyMakeNonNative(Shape* shape);
+
+    // As for setLastProperty(), but changes the class associated with the
+    // object to a native one. The object's type has already been changed, and
+    // this brings the shape into sync with it.
+    void setLastPropertyMakeNative(ExclusiveContext* cx, Shape* shape);
+
+    // Newly-created TypedArrays that map a SharedArrayBuffer are
+    // marked as shared by giving them an ObjectElements that has the
+    // ObjectElements::SHARED_MEMORY flag set.
+    void setIsSharedMemory() {
+        MOZ_ASSERT(elements_ == emptyObjectElements);
+        elements_ = emptyObjectElementsShared;
+    }
+
+    bool isInWholeCellBuffer() const {
+        const gc::TenuredCell* cell = &asTenured();
+        gc::ArenaCellSet* cells = cell->arena()->bufferedCells;
+        return cells && cells->hasCell(cell);
+    }
+
+  protected:
+#ifdef DEBUG
+    void checkShapeConsistency();
+#else
+    void checkShapeConsistency() { }
+#endif
+
+    Shape*
+    replaceWithNewEquivalentShape(ExclusiveContext* cx,
+                                  Shape* existingShape, Shape* newShape = nullptr,
+                                  bool accessorShape = false);
+
+    /*
+     * Remove the last property of an object, provided that it is safe to do so
+     * (the shape and previous shape do not carry conflicting information about
+     * the object itself).
+     */
+    inline void removeLastProperty(ExclusiveContext* cx);
+    inline bool canRemoveLastProperty();
+
+    /*
+     * Update the slot span directly for a dictionary object, and allocate
+     * slots to cover the new span if necessary.
+     */
+    bool setSlotSpan(ExclusiveContext* cx, uint32_t span);
+
+    bool toDictionaryMode(ExclusiveContext* cx);
+
+  private:
+    friend class TenuringTracer;
+
+    /*
+     * Get internal pointers to the range of values starting at start and
+     * running for length.
+     */
+    void getSlotRangeUnchecked(uint32_t start, uint32_t length,
+                               HeapSlot** fixedStart, HeapSlot** fixedEnd,
+                               HeapSlot** slotsStart, HeapSlot** slotsEnd)
+    {
+        MOZ_ASSERT(start + length >= start);
+
+        uint32_t fixed = numFixedSlots();
+        if (start < fixed) {
+            if (start + length < fixed) {
+                *fixedStart = &fixedSlots()[start];
+                *fixedEnd = &fixedSlots()[start + length];
+                *slotsStart = *slotsEnd = nullptr;
+            } else {
+                uint32_t localCopy = fixed - start;
+                *fixedStart = &fixedSlots()[start];
+                *fixedEnd = &fixedSlots()[start + localCopy];
+                *slotsStart = &slots_[0];
+                *slotsEnd = &slots_[length - localCopy];
+            }
+        } else {
+            *fixedStart = *fixedEnd = nullptr;
+            *slotsStart = &slots_[start - fixed];
+            *slotsEnd = &slots_[start - fixed + length];
+        }
+    }
+
+    void getSlotRange(uint32_t start, uint32_t length,
+                      HeapSlot** fixedStart, HeapSlot** fixedEnd,
+                      HeapSlot** slotsStart, HeapSlot** slotsEnd)
+    {
+        MOZ_ASSERT(slotInRange(start + length, SENTINEL_ALLOWED));
+        getSlotRangeUnchecked(start, length, fixedStart, fixedEnd, slotsStart, slotsEnd);
+    }
+
+  protected:
+    friend class GCMarker;
+    friend class Shape;
+    friend class NewObjectCache;
+
+    void invalidateSlotRange(uint32_t start, uint32_t length) {
+#ifdef DEBUG
+        HeapSlot* fixedStart;
+        HeapSlot* fixedEnd;
+        HeapSlot* slotsStart;
+        HeapSlot* slotsEnd;
+        getSlotRange(start, length, &fixedStart, &fixedEnd, &slotsStart, &slotsEnd);
+        Debug_SetSlotRangeToCrashOnTouch(fixedStart, fixedEnd);
+        Debug_SetSlotRangeToCrashOnTouch(slotsStart, slotsEnd);
+#endif /* DEBUG */
+    }
+
+    void initializeSlotRange(uint32_t start, uint32_t count);
+
+    /*
+     * Initialize a flat array of slots to this object at a start slot.  The
+     * caller must ensure that are enough slots.
+     */
+    void initSlotRange(uint32_t start, const Value* vector, uint32_t length);
+
+    /*
+     * Copy a flat array of slots to this object at a start slot. Caller must
+     * ensure there are enough slots in this object.
+     */
+    void copySlotRange(uint32_t start, const Value* vector, uint32_t length);
+
+#ifdef DEBUG
+    enum SentinelAllowed {
+        SENTINEL_NOT_ALLOWED,
+        SENTINEL_ALLOWED
+    };
+
+    /*
+     * Check that slot is in range for the object's allocated slots.
+     * If sentinelAllowed then slot may equal the slot capacity.
+     */
+    bool slotInRange(uint32_t slot, SentinelAllowed sentinel = SENTINEL_NOT_ALLOWED) const;
+#endif
+
+    /*
+     * Minimum size for dynamically allocated slots in normal Objects.
+     * ArrayObjects don't use this limit and can have a lower slot capacity,
+     * since they normally don't have a lot of slots.
+     */
+    static const uint32_t SLOT_CAPACITY_MIN = 8;
+
+    HeapSlot* fixedSlots() const {
+        return reinterpret_cast<HeapSlot*>(uintptr_t(this) + sizeof(NativeObject));
+    }
+
+  public:
+    bool generateOwnShape(ExclusiveContext* cx, Shape* newShape = nullptr) {
+        return replaceWithNewEquivalentShape(cx, lastProperty(), newShape);
+    }
+
+    bool shadowingShapeChange(ExclusiveContext* cx, const Shape& shape);
+    bool clearFlag(ExclusiveContext* cx, BaseShape::Flag flag);
+
+    // The maximum number of slots in an object.
+    // |MAX_SLOTS_COUNT * sizeof(JS::Value)| shouldn't overflow
+    // int32_t (see slotsSizeMustNotOverflow).
+    static const uint32_t MAX_SLOTS_COUNT = (1 << 28) - 1;
+
+    static void slotsSizeMustNotOverflow() {
+        static_assert(NativeObject::MAX_SLOTS_COUNT <= INT32_MAX / sizeof(JS::Value),
+                      "every caller of this method requires that a slot "
+                      "number (or slot count) count multiplied by "
+                      "sizeof(Value) can't overflow uint32_t (and sometimes "
+                      "int32_t, too)");
+    }
+
+    uint32_t numFixedSlots() const {
+        return reinterpret_cast<const shadow::Object*>(this)->numFixedSlots();
+    }
+    uint32_t numUsedFixedSlots() const {
+        uint32_t nslots = lastProperty()->slotSpan(getClass());
+        return Min(nslots, numFixedSlots());
+    }
+    uint32_t numFixedSlotsForCompilation() const;
+
+    uint32_t slotSpan() const {
+        if (inDictionaryMode())
+            return lastProperty()->base()->slotSpan();
+        return lastProperty()->slotSpan();
+    }
+
+    /* Whether a slot is at a fixed offset from this object. */
+    bool isFixedSlot(size_t slot) {
+        return slot < numFixedSlots();
+    }
+
+    /* Index into the dynamic slots array to use for a dynamic slot. */
+    size_t dynamicSlotIndex(size_t slot) {
+        MOZ_ASSERT(slot >= numFixedSlots());
+        return slot - numFixedSlots();
+    }
+
+    /*
+     * Grow or shrink slots immediately before changing the slot span.
+     * The number of allocated slots is not stored explicitly, and changes to
+     * the slots must track changes in the slot span.
+     */
+    bool growSlots(ExclusiveContext* cx, uint32_t oldCount, uint32_t newCount);
+    void shrinkSlots(ExclusiveContext* cx, uint32_t oldCount, uint32_t newCount);
+
+    /*
+     * This method is static because it's called from JIT code. On OOM, returns
+     * false without leaving a pending exception on the context.
+     */
+    static bool growSlotsDontReportOOM(ExclusiveContext* cx, NativeObject* obj, uint32_t newCount);
+
+    bool hasDynamicSlots() const { return !!slots_; }
+
+    /* Compute dynamicSlotsCount() for this object. */
+    uint32_t numDynamicSlots() const {
+        return dynamicSlotsCount(numFixedSlots(), slotSpan(), getClass());
+    }
+
+    bool empty() const {
+        return lastProperty()->isEmptyShape();
+    }
+
+    Shape* lookup(ExclusiveContext* cx, jsid id);
+    Shape* lookup(ExclusiveContext* cx, PropertyName* name) {
+        return lookup(cx, NameToId(name));
+    }
+
+    bool contains(ExclusiveContext* cx, jsid id) {
+        return lookup(cx, id) != nullptr;
+    }
+    bool contains(ExclusiveContext* cx, PropertyName* name) {
+        return lookup(cx, name) != nullptr;
+    }
+    bool contains(ExclusiveContext* cx, Shape* shape) {
+        return lookup(cx, shape->propid()) == shape;
+    }
+
+    bool containsShapeOrElement(ExclusiveContext* cx, jsid id) {
+        if (JSID_IS_INT(id) && containsDenseElement(JSID_TO_INT(id)))
+            return true;
+        return contains(cx, id);
+    }
+
+    /* Contextless; can be called from other pure code. */
+    Shape* lookupPure(jsid id);
+    Shape* lookupPure(PropertyName* name) {
+        return lookupPure(NameToId(name));
+    }
+
+    bool containsPure(jsid id) {
+        return lookupPure(id) != nullptr;
+    }
+    bool containsPure(PropertyName* name) {
+        return containsPure(NameToId(name));
+    }
+    bool containsPure(Shape* shape) {
+        return lookupPure(shape->propid()) == shape;
+    }
+
+    /*
+     * Allocate and free an object slot.
+     *
+     * FIXME: bug 593129 -- slot allocation should be done by object methods
+     * after calling object-parameter-free shape methods, avoiding coupling
+     * logic across the object vs. shape module wall.
+     */
+    static bool allocSlot(ExclusiveContext* cx, HandleNativeObject obj, uint32_t* slotp);
+    void freeSlot(ExclusiveContext* cx, uint32_t slot);
+
+  private:
+    static Shape* getChildPropertyOnDictionary(ExclusiveContext* cx, HandleNativeObject obj,
+                                               HandleShape parent, MutableHandle<StackShape> child);
+    static Shape* getChildProperty(ExclusiveContext* cx, HandleNativeObject obj,
+                                   HandleShape parent, MutableHandle<StackShape> child);
+
+  public:
+    /* Add a property whose id is not yet in this scope. */
+    static Shape* addProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId id,
+                              JSGetterOp getter, JSSetterOp setter,
+                              uint32_t slot, unsigned attrs, unsigned flags,
+                              bool allowDictionary = true);
+
+    /* Add a data property whose id is not yet in this scope. */
+    Shape* addDataProperty(ExclusiveContext* cx,
+                           jsid id_, uint32_t slot, unsigned attrs);
+    Shape* addDataProperty(ExclusiveContext* cx, HandlePropertyName name,
+                           uint32_t slot, unsigned attrs);
+
+    /* Add or overwrite a property for id in this scope. */
+    static Shape*
+    putProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId id,
+                JSGetterOp getter, JSSetterOp setter,
+                uint32_t slot, unsigned attrs,
+                unsigned flags);
+    static inline Shape*
+    putProperty(ExclusiveContext* cx, HandleObject obj, PropertyName* name,
+                JSGetterOp getter, JSSetterOp setter,
+                uint32_t slot, unsigned attrs,
+                unsigned flags);
+
+    /* Change the given property into a sibling with the same id in this scope. */
+    static Shape*
+    changeProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleShape shape,
+                   unsigned attrs, JSGetterOp getter, JSSetterOp setter);
+
+    /* Remove the property named by id from this object. */
+    bool removeProperty(ExclusiveContext* cx, jsid id);
+
+    /* Clear the scope, making it empty. */
+    static void clear(ExclusiveContext* cx, HandleNativeObject obj);
+
+  protected:
+    /*
+     * Internal helper that adds a shape not yet mapped by this object.
+     *
+     * Notes:
+     * 1. getter and setter must be normalized based on flags (see jsscope.cpp).
+     * 2. Checks for non-extensibility must be done by callers.
+     */
+    static Shape*
+    addPropertyInternal(ExclusiveContext* cx, HandleNativeObject obj, HandleId id,
+                        JSGetterOp getter, JSSetterOp setter, uint32_t slot, unsigned attrs,
+                        unsigned flags, ShapeTable::Entry* entry, bool allowDictionary,
+                        const AutoKeepShapeTables& keep);
+
+    bool fillInAfterSwap(JSContext* cx, const Vector<Value>& values, void* priv);
+
+  public:
+    // Return true if this object has been converted from shared-immutable
+    // prototype-rooted shape storage to dictionary-shapes in a doubly-linked
+    // list.
+    bool inDictionaryMode() const {
+        return lastProperty()->inDictionary();
+    }
+
+    const Value& getSlot(uint32_t slot) const {
+        MOZ_ASSERT(slotInRange(slot));
+        uint32_t fixed = numFixedSlots();
+        if (slot < fixed)
+            return fixedSlots()[slot];
+        return slots_[slot - fixed];
+    }
+
+    const HeapSlot* getSlotAddressUnchecked(uint32_t slot) const {
+        uint32_t fixed = numFixedSlots();
+        if (slot < fixed)
+            return fixedSlots() + slot;
+        return slots_ + (slot - fixed);
+    }
+
+    HeapSlot* getSlotAddressUnchecked(uint32_t slot) {
+        uint32_t fixed = numFixedSlots();
+        if (slot < fixed)
+            return fixedSlots() + slot;
+        return slots_ + (slot - fixed);
+    }
+
+    HeapSlot* getSlotAddress(uint32_t slot) {
+        /*
+         * This can be used to get the address of the end of the slots for the
+         * object, which may be necessary when fetching zero-length arrays of
+         * slots (e.g. for callObjVarArray).
+         */
+        MOZ_ASSERT(slotInRange(slot, SENTINEL_ALLOWED));
+        return getSlotAddressUnchecked(slot);
+    }
+
+    const HeapSlot* getSlotAddress(uint32_t slot) const {
+        /*
+         * This can be used to get the address of the end of the slots for the
+         * object, which may be necessary when fetching zero-length arrays of
+         * slots (e.g. for callObjVarArray).
+         */
+        MOZ_ASSERT(slotInRange(slot, SENTINEL_ALLOWED));
+        return getSlotAddressUnchecked(slot);
+    }
+
+    HeapSlot& getSlotRef(uint32_t slot) {
+        MOZ_ASSERT(slotInRange(slot));
+        return *getSlotAddress(slot);
+    }
+
+    const HeapSlot& getSlotRef(uint32_t slot) const {
+        MOZ_ASSERT(slotInRange(slot));
+        return *getSlotAddress(slot);
+    }
+
+    void setSlot(uint32_t slot, const Value& value) {
+        MOZ_ASSERT(slotInRange(slot));
+        MOZ_ASSERT(IsObjectValueInCompartment(value, compartment()));
+        getSlotRef(slot).set(this, HeapSlot::Slot, slot, value);
+    }
+
+    void initSlot(uint32_t slot, const Value& value) {
+        MOZ_ASSERT(getSlot(slot).isUndefined());
+        MOZ_ASSERT(slotInRange(slot));
+        MOZ_ASSERT(IsObjectValueInCompartment(value, compartment()));
+        initSlotUnchecked(slot, value);
+    }
+
+    void initSlotUnchecked(uint32_t slot, const Value& value) {
+        getSlotAddressUnchecked(slot)->init(this, HeapSlot::Slot, slot, value);
+    }
+
+    // MAX_FIXED_SLOTS is the biggest number of fixed slots our GC
+    // size classes will give an object.
+    static const uint32_t MAX_FIXED_SLOTS = 16;
+
+  protected:
+    inline bool updateSlotsForSpan(ExclusiveContext* cx, size_t oldSpan, size_t newSpan);
+
+  private:
+    void prepareElementRangeForOverwrite(size_t start, size_t end) {
+        MOZ_ASSERT(end <= getDenseInitializedLength());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        for (size_t i = start; i < end; i++)
+            elements_[i].HeapSlot::~HeapSlot();
+    }
+
+    /*
+     * Trigger the write barrier on a range of slots that will no longer be
+     * reachable.
+     */
+    void prepareSlotRangeForOverwrite(size_t start, size_t end) {
+        for (size_t i = start; i < end; i++)
+            getSlotAddressUnchecked(i)->HeapSlot::~HeapSlot();
+    }
+
+  public:
+    static bool rollbackProperties(ExclusiveContext* cx, HandleNativeObject obj,
+                                   uint32_t slotSpan);
+
+    inline void setSlotWithType(ExclusiveContext* cx, Shape* shape,
+                                const Value& value, bool overwriting = true);
+
+    inline const Value& getReservedSlot(uint32_t index) const {
+        MOZ_ASSERT(index < JSSLOT_FREE(getClass()));
+        return getSlot(index);
+    }
+
+    const HeapSlot& getReservedSlotRef(uint32_t index) const {
+        MOZ_ASSERT(index < JSSLOT_FREE(getClass()));
+        return getSlotRef(index);
+    }
+
+    HeapSlot& getReservedSlotRef(uint32_t index) {
+        MOZ_ASSERT(index < JSSLOT_FREE(getClass()));
+        return getSlotRef(index);
+    }
+
+    void initReservedSlot(uint32_t index, const Value& v) {
+        MOZ_ASSERT(index < JSSLOT_FREE(getClass()));
+        initSlot(index, v);
+    }
+
+    void setReservedSlot(uint32_t index, const Value& v) {
+        MOZ_ASSERT(index < JSSLOT_FREE(getClass()));
+        setSlot(index, v);
+    }
+
+    /* For slots which are known to always be fixed, due to the way they are allocated. */
+
+    HeapSlot& getFixedSlotRef(uint32_t slot) {
+        MOZ_ASSERT(slot < numFixedSlots());
+        return fixedSlots()[slot];
+    }
+
+    const Value& getFixedSlot(uint32_t slot) const {
+        MOZ_ASSERT(slot < numFixedSlots());
+        return fixedSlots()[slot];
+    }
+
+    void setFixedSlot(uint32_t slot, const Value& value) {
+        MOZ_ASSERT(slot < numFixedSlots());
+        fixedSlots()[slot].set(this, HeapSlot::Slot, slot, value);
+    }
+
+    void initFixedSlot(uint32_t slot, const Value& value) {
+        MOZ_ASSERT(slot < numFixedSlots());
+        fixedSlots()[slot].init(this, HeapSlot::Slot, slot, value);
+    }
+
+    /*
+     * Get the number of dynamic slots to allocate to cover the properties in
+     * an object with the given number of fixed slots and slot span. The slot
+     * capacity is not stored explicitly, and the allocated size of the slot
+     * array is kept in sync with this count.
+     */
+    static uint32_t dynamicSlotsCount(uint32_t nfixed, uint32_t span, const Class* clasp);
+    static uint32_t dynamicSlotsCount(Shape* shape) {
+        return dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan(), shape->getObjectClass());
+    }
+
+    /* Elements accessors. */
+
+    // The maximum size, in sizeof(Value), of the allocation used for an
+    // object's dense elements.  (This includes space used to store an
+    // ObjectElements instance.)
+    // |MAX_DENSE_ELEMENTS_ALLOCATION * sizeof(JS::Value)| shouldn't overflow
+    // int32_t (see elementsSizeMustNotOverflow).
+    static const uint32_t MAX_DENSE_ELEMENTS_ALLOCATION = (1 << 28) - 1;
+
+    // The maximum number of usable dense elements in an object.
+    static const uint32_t MAX_DENSE_ELEMENTS_COUNT =
+        MAX_DENSE_ELEMENTS_ALLOCATION - ObjectElements::VALUES_PER_HEADER;
+
+    static void elementsSizeMustNotOverflow() {
+        static_assert(NativeObject::MAX_DENSE_ELEMENTS_COUNT <= INT32_MAX / sizeof(JS::Value),
+                      "every caller of this method require that an element "
+                      "count multiplied by sizeof(Value) can't overflow "
+                      "uint32_t (and sometimes int32_t ,too)");
+    }
+
+    ObjectElements * getElementsHeader() const {
+        return ObjectElements::fromElements(elements_);
+    }
+
+    /* Accessors for elements. */
+    bool ensureElements(ExclusiveContext* cx, uint32_t capacity) {
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        MOZ_ASSERT(!denseElementsAreFrozen());
+        if (capacity > getDenseCapacity())
+            return growElements(cx, capacity);
+        return true;
+    }
+
+    static bool goodElementsAllocationAmount(ExclusiveContext* cx, uint32_t reqAllocated,
+                                             uint32_t length, uint32_t* goodAmount);
+    bool growElements(ExclusiveContext* cx, uint32_t newcap);
+    void shrinkElements(ExclusiveContext* cx, uint32_t cap);
+    void setDynamicElements(ObjectElements* header) {
+        MOZ_ASSERT(!hasDynamicElements());
+        elements_ = header->elements();
+        MOZ_ASSERT(hasDynamicElements());
+    }
+
+    static bool CopyElementsForWrite(ExclusiveContext* cx, NativeObject* obj);
+
+    bool maybeCopyElementsForWrite(ExclusiveContext* cx) {
+        if (denseElementsAreCopyOnWrite())
+            return CopyElementsForWrite(cx, this);
+        return true;
+    }
+
+  private:
+    inline void ensureDenseInitializedLengthNoPackedCheck(ExclusiveContext* cx,
+                                                          uint32_t index, uint32_t extra);
+
+    // Run a post write barrier that encompasses multiple contiguous elements in a
+    // single step.
+    inline void elementsRangeWriteBarrierPost(uint32_t start, uint32_t count) {
+        for (size_t i = 0; i < count; i++) {
+            const Value& v = elements_[start + i];
+            if (v.isObject() && IsInsideNursery(&v.toObject())) {
+                JS::shadow::Runtime* shadowRuntime = shadowRuntimeFromMainThread();
+                shadowRuntime->gcStoreBufferPtr()->putSlot(this, HeapSlot::Element,
+                                                           start + i, count - i);
+                return;
+            }
+        }
+    }
+
+    // See the comment over setDenseElementUnchecked, this applies in the same way.
+    void setDenseInitializedLengthUnchecked(uint32_t length) {
+        MOZ_ASSERT(length <= getDenseCapacity());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        prepareElementRangeForOverwrite(length, getElementsHeader()->initializedLength);
+        getElementsHeader()->initializedLength = length;
+    }
+
+    // Use this function with care.  This is done to allow sparsifying frozen
+    // objects, but should only be called in a few places, and should be
+    // audited carefully!
+    void setDenseElementUnchecked(uint32_t index, const Value& val) {
+        MOZ_ASSERT(index < getDenseInitializedLength());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        elements_[index].set(this, HeapSlot::Element, index, val);
+    }
+
+  public:
+    void setDenseInitializedLength(uint32_t length) {
+        MOZ_ASSERT(!denseElementsAreFrozen());
+        setDenseInitializedLengthUnchecked(length);
+    }
+
+    inline void ensureDenseInitializedLength(ExclusiveContext* cx,
+                                             uint32_t index, uint32_t extra);
+
+    void setDenseElement(uint32_t index, const Value& val) {
+        MOZ_ASSERT(!denseElementsAreFrozen());
+        setDenseElementUnchecked(index, val);
+    }
+
+    void initDenseElement(uint32_t index, const Value& val) {
+        MOZ_ASSERT(index < getDenseInitializedLength());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        MOZ_ASSERT(!denseElementsAreFrozen());
+        elements_[index].init(this, HeapSlot::Element, index, val);
+    }
+
+    void setDenseElementMaybeConvertDouble(uint32_t index, const Value& val) {
+        if (val.isInt32() && shouldConvertDoubleElements())
+            setDenseElement(index, DoubleValue(val.toInt32()));
+        else
+            setDenseElement(index, val);
+    }
+
+    inline void setDenseElementWithType(ExclusiveContext* cx, uint32_t index,
+                                        const Value& val);
+    inline void initDenseElementWithType(ExclusiveContext* cx, uint32_t index,
+                                         const Value& val);
+    inline void setDenseElementHole(ExclusiveContext* cx, uint32_t index);
+    static inline void removeDenseElementForSparseIndex(ExclusiveContext* cx,
+                                                        HandleNativeObject obj, uint32_t index);
+
+    inline Value getDenseOrTypedArrayElement(uint32_t idx);
+
+    void copyDenseElements(uint32_t dstStart, const Value* src, uint32_t count) {
+        MOZ_ASSERT(dstStart + count <= getDenseCapacity());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        MOZ_ASSERT(!denseElementsAreFrozen());
+        if (JS::shadow::Zone::asShadowZone(zone())->needsIncrementalBarrier()) {
+            for (uint32_t i = 0; i < count; ++i)
+                elements_[dstStart + i].set(this, HeapSlot::Element, dstStart + i, src[i]);
+        } else {
+            memcpy(&elements_[dstStart], src, count * sizeof(HeapSlot));
+            elementsRangeWriteBarrierPost(dstStart, count);
+        }
+    }
+
+    void initDenseElements(uint32_t dstStart, const Value* src, uint32_t count) {
+        MOZ_ASSERT(dstStart + count <= getDenseCapacity());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        MOZ_ASSERT(!denseElementsAreFrozen());
+        memcpy(&elements_[dstStart], src, count * sizeof(HeapSlot));
+        elementsRangeWriteBarrierPost(dstStart, count);
+    }
+
+    void moveDenseElements(uint32_t dstStart, uint32_t srcStart, uint32_t count) {
+        MOZ_ASSERT(dstStart + count <= getDenseCapacity());
+        MOZ_ASSERT(srcStart + count <= getDenseInitializedLength());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        MOZ_ASSERT(!denseElementsAreFrozen());
+
+        /*
+         * Using memmove here would skip write barriers. Also, we need to consider
+         * an array containing [A, B, C], in the following situation:
+         *
+         * 1. Incremental GC marks slot 0 of array (i.e., A), then returns to JS code.
+         * 2. JS code moves slots 1..2 into slots 0..1, so it contains [B, C, C].
+         * 3. Incremental GC finishes by marking slots 1 and 2 (i.e., C).
+         *
+         * Since normal marking never happens on B, it is very important that the
+         * write barrier is invoked here on B, despite the fact that it exists in
+         * the array before and after the move.
+        */
+        if (JS::shadow::Zone::asShadowZone(zone())->needsIncrementalBarrier()) {
+            if (dstStart < srcStart) {
+                HeapSlot* dst = elements_ + dstStart;
+                HeapSlot* src = elements_ + srcStart;
+                for (uint32_t i = 0; i < count; i++, dst++, src++)
+                    dst->set(this, HeapSlot::Element, dst - elements_, *src);
+            } else {
+                HeapSlot* dst = elements_ + dstStart + count - 1;
+                HeapSlot* src = elements_ + srcStart + count - 1;
+                for (uint32_t i = 0; i < count; i++, dst--, src--)
+                    dst->set(this, HeapSlot::Element, dst - elements_, *src);
+            }
+        } else {
+            memmove(elements_ + dstStart, elements_ + srcStart, count * sizeof(HeapSlot));
+            elementsRangeWriteBarrierPost(dstStart, count);
+        }
+    }
+
+    void moveDenseElementsNoPreBarrier(uint32_t dstStart, uint32_t srcStart, uint32_t count) {
+        MOZ_ASSERT(!shadowZone()->needsIncrementalBarrier());
+
+        MOZ_ASSERT(dstStart + count <= getDenseCapacity());
+        MOZ_ASSERT(srcStart + count <= getDenseCapacity());
+        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+        MOZ_ASSERT(!denseElementsAreFrozen());
+
+        memmove(elements_ + dstStart, elements_ + srcStart, count * sizeof(Value));
+        elementsRangeWriteBarrierPost(dstStart, count);
+    }
+
+    bool shouldConvertDoubleElements() {
+        return getElementsHeader()->shouldConvertDoubleElements();
+    }
+
+    inline void setShouldConvertDoubleElements();
+    inline void clearShouldConvertDoubleElements();
+
+    bool denseElementsAreCopyOnWrite() {
+        return getElementsHeader()->isCopyOnWrite();
+    }
+
+    bool denseElementsAreFrozen() {
+        return getElementsHeader()->isFrozen();
+    }
+
+    /* Packed information for this object's elements. */
+    inline bool writeToIndexWouldMarkNotPacked(uint32_t index);
+    inline void markDenseElementsNotPacked(ExclusiveContext* cx);
+
+    // Ensures that the object can hold at least index + extra elements. This
+    // returns DenseElement_Success on success, DenseElement_Failed on failure
+    // to grow the array, or DenseElement_Incomplete when the object is too
+    // sparse to grow (this includes the case of index + extra overflow). In
+    // the last two cases the object is kept intact.
+    inline DenseElementResult ensureDenseElements(ExclusiveContext* cx,
+                                                  uint32_t index, uint32_t extra);
+
+    inline DenseElementResult extendDenseElements(ExclusiveContext* cx,
+                                                  uint32_t requiredCapacity, uint32_t extra);
+
+    /* Convert a single dense element to a sparse property. */
+    static bool sparsifyDenseElement(ExclusiveContext* cx,
+                                     HandleNativeObject obj, uint32_t index);
+
+    /* Convert all dense elements to sparse properties. */
+    static bool sparsifyDenseElements(ExclusiveContext* cx, HandleNativeObject obj);
+
+    /* Small objects are dense, no matter what. */
+    static const uint32_t MIN_SPARSE_INDEX = 1000;
+
+    /*
+     * Element storage for an object will be sparse if fewer than 1/8 indexes
+     * are filled in.
+     */
+    static const unsigned SPARSE_DENSITY_RATIO = 8;
+
+    /*
+     * Check if after growing the object's elements will be too sparse.
+     * newElementsHint is an estimated number of elements to be added.
+     */
+    bool willBeSparseElements(uint32_t requiredCapacity, uint32_t newElementsHint);
+
+    /*
+     * After adding a sparse index to obj, see if it should be converted to use
+     * dense elements.
+     */
+    static DenseElementResult maybeDensifySparseElements(ExclusiveContext* cx,
+                                                         HandleNativeObject obj);
+
+    inline HeapSlot* fixedElements() const {
+        static_assert(2 * sizeof(Value) == sizeof(ObjectElements),
+                      "when elements are stored inline, the first two "
+                      "slots will hold the ObjectElements header");
+        return &fixedSlots()[2];
+    }
+
+#ifdef DEBUG
+    bool canHaveNonEmptyElements();
+#endif
+
+    void setFixedElements() {
+        MOZ_ASSERT(canHaveNonEmptyElements());
+        elements_ = fixedElements();
+    }
+
+    inline bool hasDynamicElements() const {
+        /*
+         * Note: for objects with zero fixed slots this could potentially give
+         * a spurious 'true' result, if the end of this object is exactly
+         * aligned with the end of its arena and dynamic slots are allocated
+         * immediately afterwards. Such cases cannot occur for dense arrays
+         * (which have at least two fixed slots) and can only result in a leak.
+         */
+        return !hasEmptyElements() && elements_ != fixedElements();
+    }
+
+    inline bool hasFixedElements() const {
+        return elements_ == fixedElements();
+    }
+
+    inline bool hasEmptyElements() const {
+        return elements_ == emptyObjectElements || elements_ == emptyObjectElementsShared;
+    }
+
+    /*
+     * Get a pointer to the unused data in the object's allocation immediately
+     * following this object, for use with objects which allocate a larger size
+     * class than they need and store non-elements data inline.
+     */
+    inline uint8_t* fixedData(size_t nslots) const;
+
+    inline void privateWriteBarrierPre(void** oldval);
+
+    void privateWriteBarrierPost(void** pprivate) {
+        gc::Cell** cellp = reinterpret_cast<gc::Cell**>(pprivate);
+        MOZ_ASSERT(cellp);
+        MOZ_ASSERT(*cellp);
+        gc::StoreBuffer* storeBuffer = (*cellp)->storeBuffer();
+        if (storeBuffer)
+            storeBuffer->putCell(cellp);
+    }
+
+    /* Private data accessors. */
+
+    inline void*& privateRef(uint32_t nfixed) const { /* XXX should be private, not protected! */
+        /*
+         * The private pointer of an object can hold any word sized value.
+         * Private pointers are stored immediately after the last fixed slot of
+         * the object.
+         */
+        MOZ_ASSERT(nfixed == numFixedSlots());
+        MOZ_ASSERT(hasPrivate());
+        HeapSlot* end = &fixedSlots()[nfixed];
+        return *reinterpret_cast<void**>(end);
+    }
+
+    bool hasPrivate() const {
+        return getClass()->hasPrivate();
+    }
+    void* getPrivate() const {
+        return privateRef(numFixedSlots());
+    }
+    void setPrivate(void* data) {
+        void** pprivate = &privateRef(numFixedSlots());
+        privateWriteBarrierPre(pprivate);
+        *pprivate = data;
+    }
+
+    void setPrivateGCThing(gc::Cell* cell) {
+        void** pprivate = &privateRef(numFixedSlots());
+        privateWriteBarrierPre(pprivate);
+        *pprivate = reinterpret_cast<void*>(cell);
+        privateWriteBarrierPost(pprivate);
+    }
+
+    void setPrivateUnbarriered(void* data) {
+        void** pprivate = &privateRef(numFixedSlots());
+        *pprivate = data;
+    }
+    void initPrivate(void* data) {
+        privateRef(numFixedSlots()) = data;
+    }
+
+    /* Access private data for an object with a known number of fixed slots. */
+    inline void* getPrivate(uint32_t nfixed) const {
+        return privateRef(nfixed);
+    }
+
+    static inline NativeObject*
+    copy(ExclusiveContext* cx, gc::AllocKind kind, gc::InitialHeap heap,
+         HandleNativeObject templateObject);
+
+    void updateShapeAfterMovingGC();
+    void sweepDictionaryListPointer();
+
+    /* JIT Accessors */
+    static size_t offsetOfElements() { return offsetof(NativeObject, elements_); }
+    static size_t offsetOfFixedElements() {
+        return sizeof(NativeObject) + sizeof(ObjectElements);
+    }
+
+    static size_t getFixedSlotOffset(size_t slot) {
+        return sizeof(NativeObject) + slot * sizeof(Value);
+    }
+    static size_t getPrivateDataOffset(size_t nfixed) { return getFixedSlotOffset(nfixed); }
+    static size_t offsetOfSlots() { return offsetof(NativeObject, slots_); }
+};
+
+// Object class for plain native objects created using '{}' object literals,
+// 'new Object()', 'Object.create', etc.
+class PlainObject : public NativeObject
+{
+  public:
+    static const js::Class class_;
+};
+
+inline void
+NativeObject::privateWriteBarrierPre(void** oldval)
+{
+    JS::shadow::Zone* shadowZone = this->shadowZoneFromAnyThread();
+    if (shadowZone->needsIncrementalBarrier() && *oldval && getClass()->hasTrace())
+        getClass()->doTrace(shadowZone->barrierTracer(), this);
+}
+
+#ifdef DEBUG
+static inline bool
+IsObjectValueInCompartment(const Value& v, JSCompartment* comp)
+{
+    if (!v.isObject())
+        return true;
+    return v.toObject().compartment() == comp;
+}
+#endif
+
+
+/*** Standard internal methods *******************************************************************/
+
+/*
+ * These functions should follow the algorithms in ES6 draft rev 29 section 9.1
+ * ("Ordinary Object Internal Methods"). It's an ongoing project.
+ *
+ * Many native objects are not "ordinary" in ES6, so these functions also have
+ * to serve some of the special needs of Functions (9.2, 9.3, 9.4.1), Arrays
+ * (9.4.2), Strings (9.4.3), and so on.
+ */
+
+extern bool
+NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId id,
+                     Handle<JS::PropertyDescriptor> desc,
+                     ObjectOpResult& result);
+
+extern bool
+NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId id, HandleValue value,
+                     JSGetterOp getter, JSSetterOp setter, unsigned attrs,
+                     ObjectOpResult& result);
+
+extern bool
+NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, PropertyName* name,
+                     HandleValue value, GetterOp getter, SetterOp setter,
+                     unsigned attrs, ObjectOpResult& result);
+
+extern bool
+NativeDefineElement(ExclusiveContext* cx, HandleNativeObject obj, uint32_t index, HandleValue value,
+                    JSGetterOp getter, JSSetterOp setter, unsigned attrs,
+                    ObjectOpResult& result);
+
+/* If the result out-param is omitted, throw on failure. */
+extern bool
+NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId id, HandleValue value,
+                     JSGetterOp getter, JSSetterOp setter, unsigned attrs);
+
+extern bool
+NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, PropertyName* name,
+                     HandleValue value, JSGetterOp getter, JSSetterOp setter,
+                     unsigned attrs);
+
+extern bool
+NativeHasProperty(JSContext* cx, HandleNativeObject obj, HandleId id, bool* foundp);
+
+extern bool
+NativeGetOwnPropertyDescriptor(JSContext* cx, HandleNativeObject obj, HandleId id,
+                               MutableHandle<JS::PropertyDescriptor> desc);
+
+extern bool
+NativeGetProperty(JSContext* cx, HandleNativeObject obj, HandleValue receiver, HandleId id,
+                  MutableHandleValue vp);
+
+extern bool
+NativeGetPropertyNoGC(JSContext* cx, NativeObject* obj, const Value& receiver, jsid id, Value* vp);
+
+inline bool
+NativeGetProperty(JSContext* cx, HandleNativeObject obj, HandleId id, MutableHandleValue vp)
+{
+    RootedValue receiver(cx, ObjectValue(*obj));
+    return NativeGetProperty(cx, obj, receiver, id, vp);
+}
+
+bool
+SetPropertyByDefining(JSContext* cx, HandleId id, HandleValue v, HandleValue receiver,
+                      ObjectOpResult& result);
+
+bool
+SetPropertyOnProto(JSContext* cx, HandleObject obj, HandleId id, HandleValue v,
+                   HandleValue receiver, ObjectOpResult& result);
+
+/*
+ * Indicates whether an assignment operation is qualified (`x.y = 0`) or
+ * unqualified (`y = 0`). In strict mode, the latter is an error if no such
+ * variable already exists.
+ *
+ * Used as an argument to NativeSetProperty.
+ */
+enum QualifiedBool {
+    Unqualified = 0,
+    Qualified = 1
+};
+
+extern bool
+NativeSetProperty(JSContext* cx, HandleNativeObject obj, HandleId id, HandleValue v,
+                  HandleValue receiver, QualifiedBool qualified, ObjectOpResult& result);
+
+extern bool
+NativeSetElement(JSContext* cx, HandleNativeObject obj, uint32_t index, HandleValue v,
+                 HandleValue receiver, ObjectOpResult& result);
+
+extern bool
+NativeDeleteProperty(JSContext* cx, HandleNativeObject obj, HandleId id, ObjectOpResult& result);
+
+
+/*** SpiderMonkey nonstandard internal methods ***************************************************/
+
+template <AllowGC allowGC>
+extern bool
+NativeLookupOwnProperty(ExclusiveContext* cx,
+                        typename MaybeRooted<NativeObject*, allowGC>::HandleType obj,
+                        typename MaybeRooted<jsid, allowGC>::HandleType id,
+                        typename MaybeRooted<Shape*, allowGC>::MutableHandleType propp);
+
+/*
+ * Get a property from `receiver`, after having already done a lookup and found
+ * the property on a native object `obj`.
+ *
+ * `shape` must not be null and must not be an implicit dense property. It must
+ * be present in obj's shape chain.
+ */
+extern bool
+NativeGetExistingProperty(JSContext* cx, HandleObject receiver, HandleNativeObject obj,
+                          HandleShape shape, MutableHandleValue vp);
+
+/* * */
+
+/*
+ * If obj has an already-resolved data property for id, return true and
+ * store the property value in *vp.
+ */
+extern bool
+HasDataProperty(JSContext* cx, NativeObject* obj, jsid id, Value* vp);
+
+inline bool
+HasDataProperty(JSContext* cx, NativeObject* obj, PropertyName* name, Value* vp)
+{
+    return HasDataProperty(cx, obj, NameToId(name), vp);
+}
+
+extern bool
+GetPropertyForNameLookup(JSContext* cx, HandleObject obj, HandleId id, MutableHandleValue vp);
+
+} /* namespace js */
+
+template <>
+inline bool
+JSObject::is<js::NativeObject>() const { return isNative(); }
+
+namespace js {
+
+// Alternate to JSObject::as<NativeObject>() that tolerates null pointers.
+inline NativeObject*
+MaybeNativeObject(JSObject* obj)
+{
+    return obj ? &obj->as<NativeObject>() : nullptr;
+}
+
+// Defined in NativeObject-inl.h.
+bool IsPackedArray(JSObject* obj);
+
+} // namespace js
+
+
+/*** Inline functions declared in jsobj.h that use the native declarations above *****************/
+
+inline bool
+js::HasProperty(JSContext* cx, HandleObject obj, HandleId id, bool* foundp)
+{
+    if (HasPropertyOp op = obj->getOpsHasProperty())
+        return op(cx, obj, id, foundp);
+    return NativeHasProperty(cx, obj.as<NativeObject>(), id, foundp);
+}
+
+inline bool
+js::GetProperty(JSContext* cx, HandleObject obj, HandleValue receiver, HandleId id,
+                MutableHandleValue vp)
+{
+    if (GetPropertyOp op = obj->getOpsGetProperty())
+        return op(cx, obj, receiver, id, vp);
+    return NativeGetProperty(cx, obj.as<NativeObject>(), receiver, id, vp);
+}
+
+inline bool
+js::GetPropertyNoGC(JSContext* cx, JSObject* obj, const Value& receiver, jsid id, Value* vp)
+{
+    if (obj->getOpsGetProperty())
+        return false;
+    return NativeGetPropertyNoGC(cx, &obj->as<NativeObject>(), receiver, id, vp);
+}
+
+inline bool
+js::SetProperty(JSContext* cx, HandleObject obj, HandleId id, HandleValue v,
+                HandleValue receiver, ObjectOpResult& result)
+{
+    if (obj->getOpsSetProperty())
+        return JSObject::nonNativeSetProperty(cx, obj, id, v, receiver, result);
+    return NativeSetProperty(cx, obj.as<NativeObject>(), id, v, receiver, Qualified, result);
+}
+
+inline bool
+js::SetElement(JSContext* cx, HandleObject obj, uint32_t index, HandleValue v,
+               HandleValue receiver, ObjectOpResult& result)
+{
+    if (obj->getOpsSetProperty())
+        return JSObject::nonNativeSetElement(cx, obj, index, v, receiver, result);
+    return NativeSetElement(cx, obj.as<NativeObject>(), index, v, receiver, result);
+}
+
+#endif /* vm_NativeObject_h */