tor-browser

commit 0ae81b46738fd8c776bb8b2c6d139ae4a8aa1193
parent 56c161f780b580c1945896d25a34b746ebaac3b3
Author: alexical <dothayer@mozilla.com>
Date:   Mon, 24 Nov 2025 18:51:02 +0000

Bug 2001756 - Remove erroneous GuardShape assert r=iain

Differential Revision: https://phabricator.services.mozilla.com/D273867

Diffstat:
A
js/src/jit-test/tests/ion/iterator-indices-bug2001756.js
 | 
11
+++++++++++
M
js/src/jit/ScalarReplacement.cpp
 | 
1
-

2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/js/src/jit-test/tests/ion/iterator-indices-bug2001756.js b/js/src/jit-test/tests/ion/iterator-indices-bug2001756.js
@@ -0,0 +1,11 @@
+function test(obj) {
+	var keys = Object.keys(obj);
+	keys.test = {foo: 42};
+	for (var i = 0; i < keys.test; i++) {}
+};
+
+let obj = {a:0, b: 1, c: 2};
+with ({}) {}
+for (var i = 0; i < 2000; i++) {
+  test(obj);
+}
diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
@@ -3895,7 +3895,6 @@ bool ObjectKeysReplacer::escapes(MInstruction* ins) {
         const Shape* shape = objectKeys()->resultShape();
         MOZ_DIAGNOSTIC_ASSERT(shape);
         auto* guard = def->toGuardShape();
-        MOZ_DIAGNOSTIC_ASSERT(shape == guard->shape());
         if (shape != guard->shape()) {
           JitSpewDef(JitSpew_Escape, "has a non-matching guard shape\n", def);
           return true;