Bug 1670540 - Transplant DOM_OBJECT_SLOT2 in shell. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D93213

Author: evilpie

js/src/jit-test/tests/basic/transplant-dom-slot2.js

@@ -0,0 +1,7 @@
+// Make sure to transplant DOM_OBJECT_SLOT2 for FakeDOMObject
+let source = new FakeDOMObject();
+assertEq(source.slot, 42);
+let {object: target, transplant} = transplantableObject({object: source});
+transplant(this);
+assertEq(source.slot, 42);
+assertEq(target.slot, 42);

js/src/shell/js.cpp

@@ -8415,6 +8415,11 @@ static bool TransplantObject(JSContext* cx, unsigned argc, Value* vp) {
   JS::SetReservedSlot(target, DOM_OBJECT_SLOT,
                       JS::GetReservedSlot(source, DOM_OBJECT_SLOT));
   JS::SetReservedSlot(source, DOM_OBJECT_SLOT, JS::PrivateValue(nullptr));
+  if (JS::GetClass(source) == GetDomClass()) {
+    JS::SetReservedSlot(target, DOM_OBJECT_SLOT2,
+                        JS::GetReservedSlot(source, DOM_OBJECT_SLOT2));
+    JS::SetReservedSlot(source, DOM_OBJECT_SLOT2, UndefinedValue());
+  }
 
   source = JS_TransplantObject(cx, source, target);
   if (!source) {