Bug 484151 - Initializing non-int elements calls the wrong imacro. Also call the right builtin when setting and initializing non-int properties (r=brendan).

js/src/imacros.c.out

@@ -666,11 +666,22 @@ static struct {
     },
 };
 static struct {
+    jsbytecode initprop[15];
     jsbytecode initelem[15];
 } initelem_imacros = {
     {
 /* 0*/  JSOP_PICK, 2,
 /* 2*/  JSOP_DUP,
+/* 3*/  JSOP_CALLBUILTIN, ((JSBUILTIN_SetProperty) & 0xff00) >> 8, ((JSBUILTIN_SetProperty) & 0xff),
+/* 6*/  JSOP_PICK, 4,
+/* 8*/  JSOP_PICK, 4,
+/*10*/  JSOP_CALL, 0, 2,
+/*13*/  JSOP_POP,
+/*14*/  JSOP_STOP,
+    },
+    {
+/* 0*/  JSOP_PICK, 2,
+/* 2*/  JSOP_DUP,
 /* 3*/  JSOP_CALLBUILTIN, ((JSBUILTIN_SetElement) & 0xff00) >> 8, ((JSBUILTIN_SetElement) & 0xff),
 /* 6*/  JSOP_PICK, 4,
 /* 8*/  JSOP_PICK, 4,

js/src/imacros.jsasm

@@ -713,6 +713,17 @@
 
 .igroup initelem JSOP_INITELEM
 
+    .imacro initprop                                # obj i val
+        pick 2                                      # i val obj
+        dup                                         # i val obj obj
+        callbuiltin (JSBUILTIN_SetProperty)         # i val obj fun obj
+        pick 4                                      # val obj fun obj i
+        pick 4                                      # obj fun obj i val
+        call 2                                      # obj junk
+        pop                                         # obj
+        stop
+    .end
+
     .imacro initelem                                # obj i val
         pick 2                                      # i val obj
         dup                                         # i val obj obj

js/src/jstracer.cpp

@@ -7297,7 +7297,9 @@ TraceRecorder::record_JSOP_SETELEM()
         if (!guardNotGlobalObject(obj, obj_ins))
             return false;
 
-        return call_imacro(setelem_imacros.setprop);
+        return call_imacro((*cx->fp->regs->pc == JSOP_INITELEM)
+                           ? initelem_imacros.initprop
+                           : setelem_imacros.setprop);
     }
 
     if (JSVAL_TO_INT(idx) < 0 || !OBJ_IS_DENSE_ARRAY(cx, obj)) {

js/src/trace-test.js

@@ -4647,6 +4647,14 @@ function testNEWINIT()
 testNEWINIT.expected = "[{}]";
 test(testNEWINIT);
 
+function testNEWINIT_DOUBLE()
+{
+    for (var z = 0; z < 2; ++z) { ({ 0.1: null })}
+    return "ok";
+}
+testNEWINIT_DOUBLE.expected = "ok";
+test(testNEWINIT_DOUBLE);
+
 /*****************************************************************************
  *                                                                           *
  *  _____ _   _  _____ ______ _____ _______                                  *