522101 - using JS_PropertyIterator on an array rise an assertion failure

Status: RESOLVED DUPLICATE of bug 488924

(Core :: JavaScript Engine, defect)

Description

[Franck]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
Build Identifier: tracemonkey tip

Testcase:
  JSObject *arr = JS_NewArrayObject(cx, 0, NULL);
  JSScopeProperty *jssp = NULL;
  JS_PropertyIterator(arr, &jssp); // Assertion failure: OBJ_IS_NATIVE(obj)


Reproducible: Always

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Franck, what are you using the JS_PropertyIterator for? If all you need to do is enumerate the elements of an array, you should use the JS_Enumerate API instead. The problem is that some arrays are what we call "fast arrays" which don't have JSScopeProperties to return through the PropertyIterator API.

We *could* get rid of the assertion by forcing the array to be a "slow" array, but that probably isn't what you want.

Comment 2

[Franck]

I use JS_PropertyIterator in my debugger, because I need to enumerate all properties even these without the flag JSPROP_ENUMERATE.

Comment 3

[Franck]

If I was able to detect the Array type, I could use JS_Enumerate to enumerate "fast arrays" but js_IsDenseArray is not available in the public API.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to comment #3)
> If I was able to detect the Array type, I could use JS_Enumerate to enumerate
> "fast arrays" but js_IsDenseArray is not available in the public API.

I talked this over with Brendan and the solution here is to provide a version of JS_Enumerate that gives you non-JSPROP_ENUMERATE properties. I'm a little snowed under at the moment, so I won't be able to patch it soon.

I'm going to dupe this bug to another bug that's basically exactly the same as this bug.