Bug 1078871 - Relax assertions when creating dependent strings, r=jandem.

js/src/jit-test/tests/basic/bug1078871.js

@@ -0,0 +1,44 @@
+
+// Robert Jenkins' 32 bit integer hash function
+var seed = 100;
+Math.random = function() {
+   seed = (seed + 0x7ed55d16) + (seed<<12);
+   seed = (seed ^ 0xc761c23c) ^ (seed>>19);
+   seed = (seed + 0x165667b1) + (seed<<5);
+   seed = (seed + 0xd3a2646c) ^ (seed<<9);
+   seed = (seed + 0xfd7046c5) + (seed<<3);
+   seed = (seed ^ 0xb55a4f09) ^ (seed>>16);
+   seed = Math.abs(seed | 0);
+   return seed / 0xffffffff * 2;
+}
+
+function tangle(n, m) {
+  function rand(n) {
+    return Math.floor(Math.random() * n);
+  }
+
+  var arr = [];
+  for (var i = 0; i < n; i++)
+    arr[i] = String.fromCharCode(65 + rand(26));
+  for (var i = 0; i < m; i++) {
+    var j = rand(n);
+    switch (rand(2)) {
+      case 0: {
+        var s = arr[rand(n)];
+        var b = rand(s.length);
+        var e = b + rand(s.length - b);
+        if (e - b > 1)
+          arr[j] = s.substring(b, e);
+      }
+      break;
+      case 1: {
+        arr[j] = arr[rand(n)] + arr[rand(n)];
+      }
+    }
+    uneval(arr[j]);
+  }
+
+  return arr;
+}
+
+tangle(10, 500);

js/src/vm/String-inl.h

@@ -160,15 +160,16 @@ MOZ_ALWAYS_INLINE JSLinearString *
 JSDependentString::new_(js::ExclusiveContext *cx, JSLinearString *baseArg, size_t start,
                         size_t length)
 {
-    /* Try to avoid long chains of dependent strings. */
+    /*
+     * Try to avoid long chains of dependent strings. We can't avoid these
+     * entirely, however, due to how ropes are flattened.
+     */
     if (baseArg->isDependent()) {
         start += baseArg->asDependent().baseOffset();
         baseArg = baseArg->asDependent().base();
     }
-    MOZ_ASSERT(!baseArg->isDependent());
 
     MOZ_ASSERT(start + length <= baseArg->length());
-    MOZ_ASSERT(baseArg->isFlat());
 
     /*
      * Do not create a string dependent on inline chars from another string,