Fixing http://bugzilla.mozilla.org/show_bug.cgi?id=191276 :

The reason for the bug was that omj/optimizer/Optimizer.java when optimizing code for this[name] (see GETELEM switch, line 665) assumed a number context for GETELEM index node unconditionally which is wrong.

The fix uses number context only if [] argument is known for sure to be a number.

js/rhino/src/org/mozilla/javascript/optimizer/Optimizer.java

@@ -676,11 +676,12 @@ public class Optimizer {
                     }
                     int indexType = rewriteForNumberVariables(arrayIndex);
                     if (indexType == TypeEvent.NumberType) {
-                        // setting the ISNUMBER_PROP signals the codegen
-                        // to use the scriptRuntime.getElem that takes
-                        // a double index
-                        n.putIntProp(Node.ISNUMBER_PROP, Node.RIGHT);
-                        markDCPNumberContext(arrayIndex);
+                        if (!convertParameter(arrayIndex)) {
+                            // setting the ISNUMBER_PROP signals the codegen
+                            // to use the scriptRuntime.getElem that takes
+                            // a double index
+                            n.putIntProp(Node.ISNUMBER_PROP, Node.RIGHT);
+                        }
                     }
                     return TypeEvent.NoType;
                 }