Closed Bug 617745 Opened 9 years ago Closed 9 years ago
Jaegermonkey: Assert is
Dense Array() && idx < get Dense Array Initialized Length()
The code var array1 = ['0']; (new Array(1)).splice(0,0, array1); causes assertion Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at jsobjinlines.h:335 in the current jaegermonkey tip.
This was a lingering misuse of getDenseArrayCapacity missed by bug 604045. http://hg.mozilla.org/projects/jaegermonkey/rev/0462de4a8aa1 I searched around and found a few more related to Array.concat http://hg.mozilla.org/projects/jaegermonkey/rev/eb1b0cc2360c Thanks!
You need to log in before you can comment on or make changes to this bug.