Closed
Bug 726212
Opened 12 years ago
Closed 12 years ago
"Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558" with for-of, Array, trailing holes
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla13
People
(Reporter: jorendorff, Assigned: jorendorff)
References
Details
Attachments
(1 file)
1.34 KB,
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
for (x of [,,]) {} Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558
Assignee | ||
Comment 1•12 years ago
|
||
Assignee: general → jorendorff
Attachment #596209 -
Flags: review?(jwalden+bmo)
Comment 2•12 years ago
|
||
Comment on attachment 596209 [details] [diff] [review] v1 Review of attachment 596209 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit-test/tests/for-of/array-holes-6.js @@ +1,1 @@ > +// for-of visits each hole in an array full of holes. Add an indexed property to Array.prototype, and a separate one to Object.prototype, and check for them when for-ofing below? Just to be sure.
Attachment #596209 -
Flags: review?(jwalden+bmo) → review+
Assignee | ||
Comment 4•12 years ago
|
||
> Add an indexed property to Array.prototype, and a separate one to
> Object.prototype, and check for them when for-ofing below? Just to be sure.
Added.
Assignee | ||
Comment 5•12 years ago
|
||
The patch in bug 725168 fixed this bug automagically, so this check-in is just the tests. https://hg.mozilla.org/integration/mozilla-inbound/rev/4d9810a2c2b5
Comment 6•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/4d9810a2c2b5
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13
You need to log in
before you can comment on or make changes to this bug.
Description
•