453747 - TM: "Assertion failure: JSVAL_IS_VOID(boxed) || JSVAL_IS_BOOLEAN(boxed)" (typeof, dense array holes?)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js -j

(function(){
  var a = [];
  var s = 10;
  for (var i = 0; i < s; ++i)
    a[i] = 1;
  a[4*s-1] = 2;
  for (var i = s+1; i < s+4; ++i)
    typeof a[i];
})();

Assertion failure: JSVAL_IS_VOID(boxed) || JSVAL_IS_BOOLEAN(boxed), at jsbuiltins.cpp:621

This bug exists on mozilla-central and tracemonkey branch.  Based on the sensitivity to the line "a[4*s-1]", I'm guessing the array has to be "dense" for the assertion to fire.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This seems to fix this.

Comment 2

[Andreas Gal :gal]

Comment on attachment 336976 [details] [diff] [review]
Proposed fix

Looks good. Any chance for a test case for this?

Comment 3

[Andreas Gal :gal]

I am happy with jesse's weird fuzzer code in trace-tests.js. Anything is fine. Doesn't have to be pretty.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Oops, I meant to do that. I've added this (slightly) reduced testcase to trace-test.js:

+function testTypeofHole() {
+  var a = new Array(6);
+  a[5] = 3;
+  for (var i = 0; i < 6; ++i)
+    a[i] = typeof a[i];
+  return a.toString();
+}
+testTypeofHole.expected = "undefined,undefined,undefined,undefined,undefined,number"
+test(testTypeofHole);
+

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Landed as http://hg.mozilla.org/tracemonkey/rev/1a8d24f2c2aa

I think we're supposed to hold off on marking bugs as fixed until they hit mozilla-central, so I'll wait.

Comment 6

[Robert Sayre]

This should be landed and fixed.

Comment 7

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-453747.js,v  <--  regress-453747.js
initial revision: 1.1

m-c: changeset:   19332:f974d8987dab

the test in comment 4 is already in js1_8_1/trace/trace-test.js