Bug 1532376 - Assert that the group's shouldPretenure flag is respected when creating an object r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D22326

Author: jonco3

js/src/vm/ArrayObject-inl.h

@@ -42,6 +42,8 @@ inline void ArrayObject::setLength(JSContext* cx, uint32_t length) {
   MOZ_ASSERT_IF(clasp->hasFinalize(), heap == gc::TenuredHeap);
   MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
                 heap == js::gc::TenuredHeap);
+  MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
+                heap == gc::TenuredHeap);
 
   // Arrays can use their fixed slots to store elements, so can't have shapes
   // which allow named properties to be stored in the fixed slots.

js/src/vm/JSObject.cpp

@@ -4284,6 +4284,8 @@ void JSObject::debugCheckNewObject(ObjectGroup* group, Shape* shape,
                     clasp->isProxy());
   MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
                 heap == gc::TenuredHeap);
+  MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
+                heap == gc::TenuredHeap);
 
   MOZ_ASSERT(!group->realm()->hasObjectPendingMetadata());