"Assertion failure: newlen == 0 || obj->dslots[newlen - 1] != JSVAL_HOLE, at ../jsarray.cpp"

VERIFIED FIXED in mozilla1.9.2a1

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: gkw, Assigned: Waldo)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.9.2a1
assertion, regression, testcase, verified1.9.1
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.1 +
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [fixed-in-tracemonkey][fixed by bug 484750])

(Reporter)

Description

9 years ago
[,].splice([1])

Assertion failure: newlen == 0 || obj->dslots[newlen - 1] != JSVAL_HOLE, at ../jsarray.cpp:1603

(Debug TM shell, -j not needed)

autoBisect shows bug 465980 or http://hg.mozilla.org/tracemonkey/rev/7f7722d3a2dc may be related:

The first bad revision is:
changeset:   26356:7f7722d3a2dc
user:        Jeff Walden
date:        Mon Jan 12 13:07:48 2009 -0800
summary:     Bug 465980 - Some array methods don't work right on ginormous arrays.  r=brendan
Flags: blocking1.9.1?
Bad assert, fixed in http://hg.mozilla.org/tracemonkey/rev/5a51f9089384 -- I thought newlen == 0 would catch the case where nothing changed in the array (so it remained the same as before, potentially hole-ful and all), but it clearly doesn't here.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
No longer blocks: 465980
Depends on: 465980
Blocks: 465980
No longer depends on: 465980

Updated

9 years ago
Flags: blocking1.9.1? → blocking1.9.1+

Updated

9 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 2

9 years ago
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/3ba0bf539e70
Keywords: fixed1.9.1
Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the
following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre)
Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
Whiteboard: fixed-in-tracemonkey → [fixed-in-tracemonkey][fixed by bug 484750]
Target Milestone: --- → mozilla1.9.2a1
(Reporter)

Updated

9 years ago
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.