Bug 722023 - Only call GetElementIC::attachGetProp with named properties, not indexed properties. r=bhackett

--HG--
extra : rebase_source : aec995e286ec3d6bc85ed539d39840217f2ec4cf

js/src/jit-test/tests/pic/getelem-large-index.js

@@ -0,0 +1,13 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+function testProperty(i)
+{
+  actual = obj[String(i)];
+}
+
+var obj = {};
+var index = [null, 1073741824, 1073741825];
+for (var j in index)
+  testProperty(index[j]);

js/src/methodjit/PolyIC.cpp

@@ -2607,7 +2607,8 @@ GetElementIC::update(VMFrame &f, JSObject *obj, const Value &v, jsid id, Value *
      * indexes in the emitter, i.e. js_GetProtoIfDenseArray is only valid to
      * use when looking up non-integer identifiers.
      */
-    if (v.isString() && js_CheckForStringIndex(id) == id)
+    uint32_t dummy;
+    if (v.isString() && JSID_IS_ATOM(id) && !JSID_TO_ATOM(id)->isIndex(&dummy))
         return attachGetProp(f, obj, v, JSID_TO_ATOM(id)->asPropertyName(), vp);
 
     if (obj->isArguments())