Remove bogus assertions in the tracer and in ArrayCompPushImpl helper function. Bug 630377, r=brendan.

--HG--
extra : rebase_source : 1ed9f873b630f7078f275846d95fbd68b4daeabe

js/src/jit-test/tests/basic/bug630377.js

@@ -0,0 +1,7 @@
+var a = [];
+for (var i = 0; i < RUNLOOP; i++)
+    a[i] = 0;
+var b = #1=[x === "0" && (#1#.slow = 1) for (x in a)];
+assertEq(b[0], 1);
+for (var i = 1; i < RUNLOOP; i++)
+    assertEq(b[i], false);

js/src/jsarray.cpp

@@ -2059,28 +2059,34 @@ array_push1_dense(JSContext* cx, JSObject* obj, const Value &v, Value *rval)
 JS_ALWAYS_INLINE JSBool
 ArrayCompPushImpl(JSContext *cx, JSObject *obj, const Value &v)
 {
+    uint32 length = obj->getArrayLength();
+    if (obj->isSlowArray()) {
+        /* This can happen in one evil case. See bug 630377. */
+        jsid id;
+        return js_IndexToId(cx, length, &id) &&
+               js_DefineProperty(cx, obj, id, &v, NULL, NULL, JSPROP_ENUMERATE);
+    }
+
     JS_ASSERT(obj->isDenseArray());
-    uint32_t length = obj->getArrayLength();
     JS_ASSERT(length <= obj->getDenseArrayCapacity());
 
     if (length == obj->getDenseArrayCapacity()) {
         if (length > JS_ARGS_LENGTH_MAX) {
             JS_ReportErrorNumberUC(cx, js_GetErrorMessage, NULL,
                                    JSMSG_ARRAY_INIT_TOO_BIG);
-            return JS_FALSE;
+            return false;
         }
 
         /*
-         * Array comprehension cannot add holes to the array and never leaks
-         * the array before it is fully initialized. So we can use ensureSlots
-         * instead of ensureDenseArrayElements.
+         * An array comprehension cannot add holes to the array. So we can use
+         * ensureSlots instead of ensureDenseArrayElements.
          */
         if (!obj->ensureSlots(cx, length + 1))
             return false;
     }
     obj->setArrayLength(length + 1);
     obj->setDenseArrayElement(length, v);
-    return JS_TRUE;
+    return true;
 }
 
 JSBool

js/src/jstracer.cpp

@@ -16309,7 +16309,6 @@ TraceRecorder::record_JSOP_ARRAYPUSH()
     JS_ASSERT(cx->fp()->slots() + slot < cx->regs->sp - 1);
     Value &arrayval = cx->fp()->slots()[slot];
     JS_ASSERT(arrayval.isObject());
-    JS_ASSERT(arrayval.toObject().isDenseArray());
     LIns *array_ins = get(&arrayval);
     Value &elt = stackval(-1);
     LIns *elt_ins = box_value_for_native_call(elt, get(&elt));

js/src/tests/js1_8_5/extensions/jstests.list

@@ -32,4 +32,5 @@ script regress-627984-4.js
 script regress-627984-5.js
 script regress-627984-6.js
 script regress-627984-7.js
+script regress-630377.js
 script regress-631723.js

js/src/tests/js1_8_5/extensions/regress-630377.js

@@ -0,0 +1,11 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+function f(x) {
+    x.q = 1;
+}
+var a = #1=[f(#1#) for (i in [0])];
+assertEq(a.q, 1);
+assertEq(a[0], void 0);
+
+reportCompare(0, 0, 'ok');