Closed
Bug 617745
Opened 14 years ago
Closed 13 years ago
Jaegermonkey: Assert isDenseArray() && idx < getDenseArrayInitializedLength()
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
References
Details
(Whiteboard: fixed-in-jaegermonkey)
The code var array1 = ['0']; (new Array(1)).splice(0,0, array1); causes assertion Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at jsobjinlines.h:335 in the current jaegermonkey tip.
Reporter | ||
Updated•14 years ago
|
Blocks: TypeInference
Comment 1•14 years ago
|
||
This was a lingering misuse of getDenseArrayCapacity missed by bug 604045. http://hg.mozilla.org/projects/jaegermonkey/rev/0462de4a8aa1 I searched around and found a few more related to Array.concat http://hg.mozilla.org/projects/jaegermonkey/rev/eb1b0cc2360c Thanks!
Updated•14 years ago
|
Whiteboard: fixed-in-jaegermonkey
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•