Bug 836623 - Fix unnecessary growElements() call, bogus assert during object densification, r=billm.

js/src/jit-test/tests/basic/bug836563.js

@@ -0,0 +1,5 @@
+
+var x = {};
+Object.defineProperty(x, 0, { configurable: true, value: null });
+x.p = 0
+Object.defineProperty(x, 0, { value: 2 });

js/src/jit-test/tests/basic/bug836623.js

@@ -0,0 +1,13 @@
+
+x = []
+Object.defineProperty(x, 4, {
+    configurable: true
+})
+Array.prototype.pop.call(x)
+for (let y = 0; y < 9; ++y) {
+    Object.defineProperty(x, 7, {
+        configurable: true,
+        enumerable: (y != 2),
+        writable: true
+    })
+}

js/src/jsobj.cpp

@@ -2547,9 +2547,6 @@ JSObject::willBeSparseElements(unsigned requiredCapacity, unsigned newElementsHi
 /* static */ JSObject::EnsureDenseResult
 JSObject::maybeDensifySparseElements(JSContext *cx, HandleObject obj)
 {
-    /* This should only be called after adding a sparse index to an object. */
-    JS_ASSERT(JSID_IS_INT(obj->lastProperty()->propid()));
-
     /*
      * Wait until after the object goes into dictionary mode, which must happen
      * when sparsely packing any array with more than MIN_SPARSE_INDEX elements
@@ -2609,8 +2606,10 @@ JSObject::maybeDensifySparseElements(JSContext *cx, HandleObject obj)
      * properties into dense elements.
      */
 
-    if (!obj->growElements(cx, newInitializedLength))
-        return ED_FAILED;
+    if (newInitializedLength > obj->getDenseCapacity()) {
+        if (!obj->growElements(cx, newInitializedLength))
+            return ED_FAILED;
+    }
 
     obj->ensureDenseInitializedLength(cx, newInitializedLength, 0);