Closed Bug 617745 Opened 15 years ago Closed 15 years ago

Jaegermonkey: Assert isDenseArray() && idx < getDenseArrayInitializedLength()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Whiteboard: fixed-in-jaegermonkey)

The code var array1 = ['0']; (new Array(1)).splice(0,0, array1); causes assertion Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at jsobjinlines.h:335 in the current jaegermonkey tip.
Blocks: TypeInference
This was a lingering misuse of getDenseArrayCapacity missed by bug 604045. http://hg.mozilla.org/projects/jaegermonkey/rev/0462de4a8aa1 I searched around and found a few more related to Array.concat http://hg.mozilla.org/projects/jaegermonkey/rev/eb1b0cc2360c Thanks!
Whiteboard: fixed-in-jaegermonkey
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.