702262 - Array delete injects a hole but not marking array as non-simple

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Library, defect)

Description

[Felix S. Klock II [:pnkfelix, :fklock]]

(In reply to Tamarin Bot from comment #35)
> changeset: 6717:2a58c781d85d
> user:      Felix S Klock II <[e-mail]>
> summary:   Bug 688486: state tracking array simpleness (r=lhansen).
> 
> http://hg.mozilla.org/tamarin-redux/rev/2a58c781d85d

(In reply to Tamarin Bot from comment #36)
> changeset: 6718:ef9e442690e0
> user:      Felix S Klock II <[e-mail]>
> summary:   Bug 688486: mark arrays constructed via 'Array()' as simple
> (r=treilly, sr=lhansen).
> 
> http://hg.mozilla.org/tamarin-redux/rev/ef9e442690e0

changeset 6718 injected a failure in the deep builds; the actual bug is really in changeset 6717, in my opinion.

  var arr:Array = new Array();
  arr[0] = "abc"; // arr.length == 1
  arr[1] = "def"; // arr.length == 2
  arr[2] = "ghi"; // arr.length == 3


  AddTestCase("delete arr[2] again", true, delete arr[2]);
  AddTestCase("arr[2]", undefined, arr[2]);

signals an assertion failure in ArrayObject::_getUintProperty, 

  AvmAssertMsg(value != atomNotFound, "hole in simple array");

Comment 1

[Felix S. Klock II [:pnkfelix, :fklock]]

(you probably need to run the code from comment 0 with -Ojit to expose the described bug.)

Comment 2

[Felix S. Klock II [:pnkfelix, :fklock]]

I would have thought that the tests I've been running from Bug 693431 would have caught this.  Need to investigate that after I post a fix for this.

Comment 3

[Felix S. Klock II [:pnkfelix, :fklock]]

(In reply to Felix S Klock II from comment #2)
> I would have thought that the tests I've been running from Bug 693431 would
> have caught this.  Need to investigate that after I post a fix for this.

Ah its because the current patch on Bug 693431 is sorely lacking in type annotations, and so its not actually exercising the control flow paths that the jit goes through with the assertions.

A couple orthogonal work-items that spawn off from this:

1. put more assertions on the non-jitted paths.

2. expand or change the tests in Bug 693431 to include more type annotation heavy code.

Comment 4

[Tamarin Bot]

changeset: 6727:007ca8d1a8f5
user:      Felix S Klock II <[e-mail]>
summary:   Bug 702262: delete must not yield simple array (r=fklockii).

http://hg.mozilla.org/tamarin-redux/rev/007ca8d1a8f5

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.