Steps to reproduce:

The following sample crashes the js shell on commit cf3af6bb6657278880f8baf38435eeb8f2d5d86c in GetIteratorImpl<true> when invoked as: obj-x86_64-pc-linux-gnu/dist/bin/js --fast-warmup --fuzzing-safe --enable-iterator-indices --ion-warmup-threshold=100 --differential-testing crash.js
Not setting s-s because iterator-indices are disabled by default.

for (let v0 = 0; v0 < 100; v0++) {
    function F1() {
        this[-65537] = 0;
        this[-1869467081] = 0;
        for (const v6 in this) {
            this[v6];
        }
    }   
    const v8 = new F1();
}

Since Bug 1799025 part 10, this feature is now enabled by default.

It seems to me that there is a bug in the patch which made it disabled by default:
https://phabricator.services.mozilla.com/D165215

SET_DEFAULT(disableIteratorIndices, false);

Good Catch Nicolas; apologies!

Oops, I'll fix that option.

The good news is that this only affects --differential-testing. When doing differential testing, we sort enumerated keys to avoid non-determinism caused by enumeration hooks on native objects (see bug 707017). The associated indices aren't sorted, so the two lists get out of sync. We still only access valid properties, but we do so in the wrong order / for the wrong keys.

Fortunately, because we don't support the indices optimization for objects with enumeration hooks, there's no overlap between the cases where we have indices and the cases where we need to sort. So we should be able to just skip sorting if indices are present, and it shouldn't impede fuzzing.

We sort to avoid complications with enumeration hooks, but if there are valid indices, then we know there aren't any enumeration hooks.

Making this more like other ion optimization flags.

Depends on D167733

https://hg.mozilla.org/mozilla-central/rev/2212baf78cf4
https://hg.mozilla.org/mozilla-central/rev/c27d72cbf0a6