Bug 1057582 - Remove a bogus assert. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 26 Aug 2014 10:14:06 +0200
changeset 201630 68bb8434fbec690eb9e41fd0daf281cbefff2c5d
parent 201629 8530535e1ae054a8ddc59225d7f12a1a950ed37f
child 201631 e48a1782de89eca7b4de7f96b2bbe00cc29b3230
push id8376
push userryanvm@gmail.com
push dateTue, 26 Aug 2014 20:12:13 +0000
treeherderfx-team@2e9bbd03df15 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1057582
milestone34.0a1
Bug 1057582 - Remove a bogus assert. r=bhackett
js/src/jit-test/tests/ion/bug1057582.js
js/src/jit/VMFunctions.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1057582.js
@@ -0,0 +1,10 @@
+Object.defineProperty(Object.prototype, "0", {configurable: true});
+delete Object.prototype[0];
+
+function makeArray() {
+    var arr = [];
+    for (var i = 0; i < 10; i++)
+        arr.push(true);
+    return arr;
+}
+makeArray();
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -397,17 +397,16 @@ ArrayPopDense(JSContext *cx, HandleObjec
     return true;
 }
 
 bool
 ArrayPushDense(JSContext *cx, HandleObject obj, HandleValue v, uint32_t *length)
 {
     JS_ASSERT(obj->is<ArrayObject>());
     JS_ASSERT(obj->as<ArrayObject>().lengthIsWritable());
-    JS_ASSERT(!ObjectMayHaveExtraIndexedProperties(obj));
 
     uint32_t idx = obj->as<ArrayObject>().length();
     JSObject::EnsureDenseResult result = obj->ensureDenseElements(cx, idx, 1);
     if (result == JSObject::ED_FAILED)
         return false;
 
     if (result == JSObject::ED_OK) {
         obj->setDenseElement(idx, v);