From cc58e887c3dedbb65f2787c79dda439120909ffd Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Mon, 18 Oct 2010 19:04:29 -0700
Subject: [PATCH] Bug 595911 - Don't assume 32-bit integer property names are
 also INT_FITS_IN_JSID.  r=brendan

---
 js/src/jstracer.cpp                           | 11 ++++++++-
 .../tests/basic/delete-integer-nonid.js       | 24 +++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 js/src/trace-test/tests/basic/delete-integer-nonid.js

diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index eec545e344c..d118ea47712 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -11879,7 +11879,16 @@ DeleteIntKey(JSContext* cx, JSObject* obj, int32 i, JSBool strict)
 {
     LeaveTraceIfGlobalObject(cx, obj);
     Value v = BooleanValue(false);
-    jsid id = INT_TO_JSID(i);
+    jsid id;
+    if (INT_FITS_IN_JSID(i)) {
+        id = INT_TO_JSID(i);
+    } else {
+        if (!js_ValueToStringId(cx, Int32Value(i), &id)) {
+            SetBuiltinError(cx);
+            return false;
+        }
+    }
+
     if (!obj->deleteProperty(cx, id, &v, strict))
         SetBuiltinError(cx);
     return v.toBoolean();
diff --git a/js/src/trace-test/tests/basic/delete-integer-nonid.js b/js/src/trace-test/tests/basic/delete-integer-nonid.js
new file mode 100644
index 00000000000..e016227cbab
--- /dev/null
+++ b/js/src/trace-test/tests/basic/delete-integer-nonid.js
@@ -0,0 +1,24 @@
+var JSID_INT_MIN = -(1 << 30);
+var JSID_INT_MAX = (1 << 30) - 1;
+
+var o = {};
+
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MIN - 1];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MIN];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MIN + 1];
+
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MAX - 1];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MAX];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MAX + 1];