Bug 1460381 - Follow-up to fix test bustage and add some more tests. r=anba

js/src/jit/CacheIR.cpp

@@ -3477,13 +3477,13 @@ SetPropIRGenerator::tryAttachSetDenseElement(HandleObject obj, ObjOperandId objI
 }
 
 static bool
-CanAttachAddElement(JSObject* obj, bool isInit)
+CanAttachAddElement(NativeObject* obj, bool isInit)
 {
     // Make sure the objects on the prototype don't have any indexed properties
     // or that such properties can't appear without a shape change.
     do {
         // The first two checks are also relevant to the receiver object.
-        if (obj->isNative() && obj->as<NativeObject>().isIndexed())
+        if (obj->isIndexed())
             return false;
 
         const Class* clasp = obj->getClass();
@@ -3522,7 +3522,7 @@ CanAttachAddElement(JSObject* obj, bool isInit)
         if (!nproto->isExtensible() && nproto->getDenseInitializedLength() > 0)
             return false;
 
-        obj = proto;
+        obj = nproto;
     } while (true);
 
     return true;
@@ -4393,7 +4393,7 @@ CallIRGenerator::tryAttachArrayPush()
         return false;
 
     // Check for other indexed properties or class hooks.
-    if (!CanAttachAddElement(thisobj, /* isInit = */ false))
+    if (!CanAttachAddElement(thisarray, /* isInit = */ false))
         return false;
 
     // Can't add new elements to arrays with non-writable length.

js/src/vm/NativeObject-inl.h

@@ -314,7 +314,7 @@ inline void
 NativeObject::ensureDenseInitializedLengthNoPackedCheck(uint32_t index, uint32_t extra)
 {
     MOZ_ASSERT(!denseElementsAreCopyOnWrite());
-    MOZ_ASSERT(isExtensible());
+    MOZ_ASSERT(!denseElementsAreFrozen());
 
     /*
      * Ensure that the array's contents have been initialized up to index, and
@@ -325,6 +325,7 @@ NativeObject::ensureDenseInitializedLengthNoPackedCheck(uint32_t index, uint32_t
     uint32_t& initlen = getElementsHeader()->initializedLength;
 
     if (initlen < index + extra) {
+        MOZ_ASSERT(isExtensible());
         uint32_t numShifted = getElementsHeader()->numShiftedElements();
         size_t offset = initlen;
         for (HeapSlot* sp = elements_ + initlen;

js/src/vm/NativeObject.cpp

@@ -528,7 +528,8 @@ NativeObject::sparsifyDenseElement(JSContext* cx, HandleNativeObject obj, uint32
     }
 
     // NOTE: We don't use addDataProperty because we don't want the
-    // extensibility check if we're, for example, sparsifying frozen objects..
+    // extensibility check if we're, for example, sparsifying an element of a
+    // non-extensible object.
     Shape* shape = addDataPropertyInternal(cx, obj, id, SHAPE_INVALID_SLOT,
                                            obj->getElementsHeader()->elementAttributes(),
                                            table, entry, keep);

js/src/vm/Shape.cpp

@@ -881,7 +881,8 @@ NativeObject::putDataProperty(JSContext* cx, HandleNativeObject obj, HandleId id
         }
 
         if (!shape) {
-            MOZ_ASSERT(obj->isExtensible(),
+            MOZ_ASSERT(obj->isExtensible() ||
+                       (JSID_IS_INT(id) && obj->containsDenseElement(JSID_TO_INT(id))),
                        "Can't add new property to non-extensible object");
             return addDataPropertyInternal(cx, obj, id, SHAPE_INVALID_SLOT, attrs, table, entry,
                                            keep);
@@ -987,7 +988,8 @@ NativeObject::putAccessorProperty(JSContext* cx, HandleNativeObject obj, HandleI
         }
 
         if (!shape) {
-            MOZ_ASSERT(obj->isExtensible(),
+            MOZ_ASSERT(obj->isExtensible() ||
+                       (JSID_IS_INT(id) && obj->containsDenseElement(JSID_TO_INT(id))),
                        "Can't add new property to non-extensible object");
             return addAccessorPropertyInternal(cx, obj, id, getter, setter, attrs, table, entry,
                                                keep);