Merge.

js/src/jsbuiltins.cpp

@@ -193,12 +193,11 @@ js_Int32ToId(JSContext* cx, int32 index, jsid* id)
     if (unsigned(index) <= JSVAL_INT_MAX) {
         *id = INT_TO_JSID(index);
         return JS_TRUE;
-    } else {
-        JSString* str = js_NumberToString(cx, index);
-        if (!str)
-            return JS_FALSE;
-        return js_ValueToStringId(cx, STRING_TO_JSVAL(str), id);
     }
+    JSString* str = js_NumberToString(cx, index);
+    if (!str)
+        return JS_FALSE;
+    return js_ValueToStringId(cx, STRING_TO_JSVAL(str), id);
 }
 
 jsval FASTCALL

js/src/jstracer.cpp

@@ -695,7 +695,7 @@ public:
                 if (d0->isconst() && d1->isconst()) {
                     int i0 = d0->constval();
                     int i1 = d1->constval();
-                    if (v == LIR_fsub)
+                    if (v == LIR_sub)
                         i1 = -i1;
                     int ir = i0 + i1;
                     /* If these overflow safely, emit an integer constant. */

js/src/trace-test.js

@@ -1893,6 +1893,14 @@ function testBug465261() {
 testBug465261.expected = true;
 test(testBug465261);
 
+function testBug465272() {
+    var a = new Array(5);
+    for (j=0;j<5;++j) a[j] = "" + ((5) - 2);
+    return a.join(",");
+}
+testBug465272.expected = "3,3,3,3,3"
+test(testBug465272);
+
 // BEGIN MANDELBROT STUFF
 // XXXbz I would dearly like to wrap it up into a function to avoid polluting
 // the global scope, but the function ends up heavyweight, and then we lose on