From 06d366fad246b42fa6fcec266d119613182aecca Mon Sep 17 00:00:00 2001
From: Jason Orendorff <jorendorff@mozilla.com>
Date: Thu, 11 Aug 2011 13:24:56 -0500
Subject: [PATCH] Bug 613452 - "Assertion failure: obj->isExtensible()" with
 Object.seal, sharps. r=Waldo.

---
 js/src/jspropertycacheinlines.h                   |  5 ++++-
 js/src/tests/js1_8_5/extensions/jstests.list      |  1 +
 js/src/tests/js1_8_5/extensions/regress-613452.js | 13 +++++++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 js/src/tests/js1_8_5/extensions/regress-613452.js

diff --git a/js/src/jspropertycacheinlines.h b/js/src/jspropertycacheinlines.h
index 96aef0b9b09..71b400333f8 100644
--- a/js/src/jspropertycacheinlines.h
+++ b/js/src/jspropertycacheinlines.h
@@ -130,7 +130,6 @@ PropertyCache::testForInit(JSRuntime *rt, jsbytecode *pc, JSObject *obj,
                            const js::Shape **shapep, PropertyCacheEntry **entryp)
 {
     JS_ASSERT(obj->slotSpan() >= JSSLOT_FREE(obj->getClass()));
-    JS_ASSERT(obj->isExtensible());
     uint32 kshape = obj->shape();
     PropertyCacheEntry *entry = &table[hash(pc, kshape)];
     *entryp = entry;
@@ -142,6 +141,10 @@ PropertyCache::testForInit(JSRuntime *rt, jsbytecode *pc, JSObject *obj,
     if (entry->kpc == pc &&
         entry->kshape == kshape &&
         entry->vshape() == rt->protoHazardShape) {
+        // If obj is not extensible, we cannot have a cache hit. This happens
+        // for sharp-variable expressions like (#1={x: Object.seal(#1#)}).
+        JS_ASSERT(obj->isExtensible());
+
         PCMETER(pchits++);
         PCMETER(inipchits++);
         JS_ASSERT(entry->vcapTag() == 0);
diff --git a/js/src/tests/js1_8_5/extensions/jstests.list b/js/src/tests/js1_8_5/extensions/jstests.list
index 3fb3a16c3ae..63a0c4411e7 100644
--- a/js/src/tests/js1_8_5/extensions/jstests.list
+++ b/js/src/tests/js1_8_5/extensions/jstests.list
@@ -34,6 +34,7 @@ script findReferences-01.js
 script findReferences-02.js
 script findReferences-03.js
 script findReferences-04.js
+script regress-613452.js
 script regress-627859.js
 script regress-627984-1.js
 script regress-627984-2.js
diff --git a/js/src/tests/js1_8_5/extensions/regress-613452.js b/js/src/tests/js1_8_5/extensions/regress-613452.js
new file mode 100644
index 00000000000..3b40c2caf1a
--- /dev/null
+++ b/js/src/tests/js1_8_5/extensions/regress-613452.js
@@ -0,0 +1,13 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+for (var i = 0; i < 2; i++) {
+    try {
+        (#1={x: Object.seal(#1#)});  // do not assert
+    } catch (exc) {}
+}
+
+for (var i = 0; i < 2; i++)
+    (#1={x: (#1#.x = 1, Object.seal(#1#))});  // do not assert
+
+reportCompare(0, 0, 'ok');