699674 - "Assertion failure: length <= INT32_MAX,"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Array(24)
for(v in(Array(2440598491))){}

asserts js debug shell on JM changeset 6dc7901db1d6 without any CLI flags at Assertion failure: length <= INT32_MAX,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79619:daa488a2e663
user:        Brian Hackett
date:        Thu Nov 03 09:57:12 2011 -0700
summary:     Add cache for constructing new objects from the VM, bug 699446.

Comment 1

[Brian Hackett [Laid off!]]

WFM on tip.  The named cset used setDenseArrayLength instead of setArrayLength in one place (the assert is actually bogus, since the type will already have been marked as having unknown properties).

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929