Closed Bug 648357 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: currentCapacity == initLength, at ../jsarray.h:100

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

--
var x = [1, 2, 3, 4, 5, 6, 7, 8];
x.pop();
x.push(9);
--
$ ./js test.js
Assertion failure: currentCapacity == initLength, at ../jsarray.h:100
Fix several places where we set the initialized length below the capacity without checking that inference was enabled.  Also fixes a couple bugs in this area where dense array paths in array natives shrank array lengths without notifying inference.

http://hg.mozilla.org/projects/jaegermonkey/rev/9f0cb8d7da58
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.