TI: interpreter gives incorrect result for array splice

RESOLVED FIXED

Status

()

RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

(Reporter)

Description

8 years ago
--
var x = [,].splice(0);
assertEq(x.length, 1);
assertEq(x[0], undefined);
--
This test works with TM tip and with -m, but fails in the interpreter:
typein:3: Error: Assertion failed: got 0, expected (void 0)
Hmm, this was an incorrect use of getDenseArrayCapacity instead of getDenseArrayInitializedLength.  I audited all uses of the former function back when adding the packed arrays (or a followup), and suspect this came in from a botched merge.  Need to be more careful.

http://hg.mozilla.org/projects/jaegermonkey/rev/9cbb9f9e8ac9
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.