Bug 631305 - Deleted watchpoints don't always come back when assigned. r=brendan, a=sayrer.

js/src/jit-test/tests/basic/bug631305.js

@@ -0,0 +1,9 @@
+var n = 0;
+var a = [];
+for (var i = 0; i < 20; i++)
+    a[i] = {};
+a[18].watch("p", function () { n++; });
+delete a[18].p;
+for (var i = 0; i < 20; i++)
+    a[i].p = 0;
+assertEq(n, 1);

js/src/jsdbgapi.cpp

@@ -1034,6 +1034,13 @@ JS_SetWatchPoint(JSContext *cx, JSObject *obj, jsid id,
         JS_APPEND_LINK(&wp->links, &rt->watchPointList);
         ++rt->debuggerMutations;
     }
+
+    /*
+     * Ensure that an object with watchpoints never has the same shape as an
+     * object without them, even if the watched properties are deleted.
+     */
+    obj->watchpointOwnShapeChange(cx);
+
     wp->handler = handler;
     wp->closure = reinterpret_cast<JSObject*>(closure);
     DBG_UNLOCK(rt);

js/src/jsobj.h

@@ -518,6 +518,7 @@ struct JSObject : js::gc::Cell {
     void protoShapeChange(JSContext *cx);
     void shadowingShapeChange(JSContext *cx, const js::Shape &shape);
     bool globalObjectOwnShapeChange(JSContext *cx);
+    void watchpointOwnShapeChange(JSContext *cx) { generateOwnShape(cx); }
 
     void extensibleShapeChange(JSContext *cx) {
         /* This will do for now. */