From f215223a81d42a96d55119174f932e5b16f9c607 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Sat, 14 Mar 2015 01:36:17 -0400
Subject: [PATCH] Bug 805052 part 2.  Stop using the shape's parent to get the
 object's global.  r=waldo

---
 js/src/vm/Shape.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index bee59b234aa..7a151b1fd49 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1708,7 +1708,7 @@ NewObjectCache::invalidateEntriesForShape(JSContext *cx, HandleShape shape, Hand
     if (CanBeFinalizedInBackground(kind, clasp))
         kind = GetBackgroundAllocKind(kind);
 
-    Rooted<GlobalObject *> global(cx, &shape->getObjectParent()->global());
+    Rooted<GlobalObject *> global(cx, shape->compartment()->unsafeUnbarrieredMaybeGlobal());
     RootedObjectGroup group(cx, ObjectGroup::defaultNewGroup(cx, clasp, TaggedProto(proto)));
 
     EntryIndex entry;