Bug 992866 - Fix assertion in JSObject::initDenseElementsUnbarriered r=sfink

js/src/jit-test/tests/gc/bug-992866.js

@@ -0,0 +1,15 @@
+if (!getBuildConfiguration().parallelJS)
+  quit(0);
+
+test([0], "map", function (... Object)  {
+  var x = [];
+  for (var i = 0; i < 10; i++) {
+      x[i] = {};
+  }
+});
+
+function test(arr, op, func) {
+  for (var i = 0; i < 1000; i++) {
+    arr[op + "Par"].apply(arr, [func, undefined]);
+  }
+}

js/src/jsobj.h

@@ -680,10 +680,11 @@ class JSObject : public js::ObjectImpl
         JS_ASSERT(dstStart + count <= getDenseCapacity());
 #if defined(DEBUG) && defined(JSGC_GENERATIONAL)
         JS::shadow::Runtime *rt = JS::shadow::Runtime::asShadowRuntime(runtimeFromAnyThread());
+        JS_ASSERT(!js::gc::IsInsideNursery(rt, this));
         for (uint32_t index = 0; index < count; ++index) {
             const JS::Value& value = src[index];
             if (value.isMarkable())
-                JS_ASSERT(js::gc::IsInsideNursery(rt, value.toGCThing()));
+                JS_ASSERT(!js::gc::IsInsideNursery(rt, value.toGCThing()));
         }
 #endif
         memcpy(&elements[dstStart], src, count * sizeof(js::HeapSlot));