[,].splice() Assertion failure: newlen == 0 || obj->dslots[newlen - 1] != JSVAL_HOLE, at ../jsarray.cpp:1603 (Debug TM shell, -j not needed) autoBisect shows bug 465980 or http://hg.mozilla.org/tracemonkey/rev/7f7722d3a2dc may be related: The first bad revision is: changeset: 26356:7f7722d3a2dc user: Jeff Walden date: Mon Jan 12 13:07:48 2009 -0800 summary: Bug 465980 - Some array methods don't work right on ginormous arrays. r=brendan
Bad assert, fixed in http://hg.mozilla.org/tracemonkey/rev/5a51f9089384 -- I thought newlen == 0 would catch the case where nothing changed in the array (so it remained the same as before, potentially hole-ful and all), but it clearly doesn't here.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
OS: Mac OS X → All
Hardware: x86 → All
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the following debug builds: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422224452 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
Whiteboard: fixed-in-tracemonkey → [fixed-in-tracemonkey][fixed by bug 484750]
Target Milestone: --- → mozilla1.9.2a1
You need to log in before you can comment on or make changes to this bug.