Remove bogus assert, bug 696039. r=dvander
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 21 Nov 2011 19:15:38 -0500
changeset 80616 4abbb8b11ffd
parent 80615 7f0892ad2a7e
child 80617 566d93e2500c
push id21515
push userbmo@edmorley.co.uk
push date2011-11-22 15:53 +0000
treeherdermozilla-central@6f998cc964be [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs696039
milestone11.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Remove bogus assert, bug 696039. r=dvander
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2431,17 +2431,16 @@ js::array_pop(JSContext *cx, uintN argc,
 }
 
 #ifdef JS_METHODJIT
 void JS_FASTCALL
 mjit::stubs::ArrayShift(VMFrame &f)
 {
     JSObject *obj = &f.regs.sp[-1].toObject();
     JS_ASSERT(obj->isDenseArray());
-    JS_ASSERT(!js_PrototypeHasIndexedProperties(f.cx, obj));
 
     /*
      * At this point the length and initialized length have already been
      * decremented and the result fetched, so just shift the array elements
      * themselves.
      */
     uint32 initlen = obj->getDenseArrayInitializedLength();
     obj->moveDenseArrayElements(0, 1, initlen);