726212 - "Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558" with for-of, Array, trailing holes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

for (x of [,,]) {}

Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 2

[Jeff Walden [:Waldo]]

Comment on attachment 596209 [details] [diff] [review]
v1

Review of attachment 596209 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/for-of/array-holes-6.js
@@ +1,1 @@
> +// for-of visits each hole in an array full of holes.

Add an indexed property to Array.prototype, and a separate one to Object.prototype, and check for them when for-ofing below?  Just to be sure.

Comment 4

[Jason Orendorff [:jorendorff]]

> Add an indexed property to Array.prototype, and a separate one to
> Object.prototype, and check for them when for-ofing below?  Just to be sure.

Added.

Comment 5

[Jason Orendorff [:jorendorff]]

The patch in bug 725168 fixed this bug automagically, so this check-in is just the tests.

https://hg.mozilla.org/integration/mozilla-inbound/rev/4d9810a2c2b5

Comment 6

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/4d9810a2c2b5