Bug 1060387 - Remove a bogus assert. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 06 Jan 2015 17:05:55 +0100
changeset 248062 aac57ca292f4e72b1c7c40accf557a3eb3c3ac43
parent 248061 b42615e51c8106d2dba57343e34a631190473cb0
child 248063 708869bcedaec6313b6d159ffd3bd341f5f28ff0
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1060387
milestone37.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1060387 - Remove a bogus assert. r=bhackett
js/src/jit-test/tests/ion/bug1060387.js
js/src/jit/VMFunctions.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1060387.js
@@ -0,0 +1,12 @@
+function foo() {
+    var obj = new Object();
+    var index = [-0, 2147483648, 1073741825];
+    for (var j in index) {
+        testProperty(index[j]);
+    }
+    function testProperty(i) {
+        obj[i] = '' + i;
+    }
+    assertEq(JSON.stringify(obj), '{"0":"0","2147483648":"2147483648","1073741825":"1073741825"}');
+}
+foo();
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -1161,19 +1161,18 @@ Recompile(JSContext *cx)
     return RecompileImpl(cx, /* force = */ false);
 }
 
 bool
 SetDenseElement(JSContext *cx, HandleNativeObject obj, int32_t index, HandleValue value,
                 bool strict)
 {
     // This function is called from Ion code for StoreElementHole's OOL path.
-    // In this case we know the object is native, has no indexed properties
-    // and we can use setDenseElement instead of setDenseElementWithType.
-    MOZ_ASSERT(!obj->isIndexed());
+    // In this case we know the object is native and we can use setDenseElement
+    // instead of setDenseElementWithType.
 
     NativeObject::EnsureDenseResult result = NativeObject::ED_SPARSE;
     do {
         if (index < 0)
             break;
         bool isArray = obj->is<ArrayObject>();
         if (isArray && !obj->as<ArrayObject>().lengthIsWritable())
             break;