Bug 1317402 - Clear the isBigEnoughForAShapeTable cache when removing dictionary shapes. r=jonco

js/src/jit-test/tests/basic/bug1317402.js

@@ -0,0 +1,8 @@
+gczeal(9);
+let o = {p1:0, p2:0, set p3({}) {}, p4:1, p5:1,
+         p6:1, p7:1, p8:1, p9:1, p10:1, p11:1};
+for (let p in o)
+    x = o[p];
+delete o.p3;
+for (let i = 0; i < 100; i++)
+    x = -o;

js/src/vm/Shape.cpp

@@ -89,6 +89,8 @@ Shape::removeFromDictionary(NativeObject* obj)
         parent->listp = listp;
     *listp = parent;
     listp = nullptr;
+
+    obj->shape_->clearCachedBigEnoughForShapeTable();
 }
 
 void

js/src/vm/Shape.h

@@ -983,6 +983,9 @@ class Shape : public gc::TenuredCell
         }
         return false;
     }
+    void clearCachedBigEnoughForShapeTable() {
+        flags &= ~(HAS_CACHED_BIG_ENOUGH_FOR_SHAPE_TABLE | CACHED_BIG_ENOUGH_FOR_SHAPE_TABLE);
+    }
 
   public:
     bool isBigEnoughForAShapeTable() {