Bug 595911 - Don't assume 32-bit integer property names are also INT_FITS_IN_JSID. r=brendan

js/src/jstracer.cpp

@@ -11879,7 +11879,16 @@ DeleteIntKey(JSContext* cx, JSObject* obj, int32 i, JSBool strict)
 {
     LeaveTraceIfGlobalObject(cx, obj);
     Value v = BooleanValue(false);
-    jsid id = INT_TO_JSID(i);
+    jsid id;
+    if (INT_FITS_IN_JSID(i)) {
+        id = INT_TO_JSID(i);
+    } else {
+        if (!js_ValueToStringId(cx, Int32Value(i), &id)) {
+            SetBuiltinError(cx);
+            return false;
+        }
+    }
+
     if (!obj->deleteProperty(cx, id, &v, strict))
         SetBuiltinError(cx);
     return v.toBoolean();

js/src/trace-test/tests/basic/delete-integer-nonid.js

@@ -0,0 +1,24 @@
+var JSID_INT_MIN = -(1 << 30);
+var JSID_INT_MAX = (1 << 30) - 1;
+
+var o = {};
+
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MIN - 1];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MIN];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MIN + 1];
+
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MAX - 1];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MAX];
+
+for (var i = 0; i < 10; i++)
+  delete o[JSID_INT_MAX + 1];