Closed Bug 640203 Opened 13 years ago Closed 13 years ago

TI: interpreter gives incorrect result for array splice

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

Details

(Whiteboard: fixed-in-jaegermonkey) 

--
var x = [,].splice(0);
assertEq(x.length, 1);
assertEq(x[0], undefined);
--
This test works with TM tip and with -m, but fails in the interpreter:
typein:3: Error: Assertion failed: got 0, expected (void 0)
Hmm, this was an incorrect use of getDenseArrayCapacity instead of getDenseArrayInitializedLength.  I audited all uses of the former function back when adding the packed arrays (or a followup), and suspect this came in from a botched merge.  Need to be more careful.

http://hg.mozilla.org/projects/jaegermonkey/rev/9cbb9f9e8ac9
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.