Bug 1532376 - Assert that the group's shouldPretenure flag is respected when creating an object r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D22326

UltraBlame original commit: 82a1c708780619b605a5c0f63cd8046f3e992692

Author: marco-c

js/src/vm/ArrayObject-inl.h

@@ -42,6 +42,8 @@ inline void ArrayObject::setLength(JSContext* cx, uint32_t length) {
   MOZ_ASSERT_IF(clasp->hasFinalize(), heap == gc::TenuredHeap);
   MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
                 heap == js::gc::TenuredHeap);
+  MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
+                heap == gc::TenuredHeap);
 
 
 

js/src/vm/JSObject.cpp

@@ -4284,6 +4284,8 @@ void JSObject::debugCheckNewObject(ObjectGroup* group, Shape* shape,
                     clasp->isProxy());
   MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
                 heap == gc::TenuredHeap);
+  MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
+                heap == gc::TenuredHeap);
 
   MOZ_ASSERT(!group->realm()->hasObjectPendingMetadata());