Closed Bug 640203 Opened 9 years ago Closed 9 years ago

TI: interpreter gives incorrect result for array splice

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

--
var x = [,].splice(0);
assertEq(x.length, 1);
assertEq(x[0], undefined);
--
This test works with TM tip and with -m, but fails in the interpreter:
typein:3: Error: Assertion failed: got 0, expected (void 0)
Hmm, this was an incorrect use of getDenseArrayCapacity instead of getDenseArrayInitializedLength.  I audited all uses of the former function back when adding the packed arrays (or a followup), and suspect this came in from a botched merge.  Need to be more careful.

http://hg.mozilla.org/projects/jaegermonkey/rev/9cbb9f9e8ac9
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.