Last Comment Bug 726212 - "Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558" with for-of, Array, trailing holes
: "Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(),...
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: All All
: -- normal (vote)
: mozilla13
Assigned To: Jason Orendorff [:jorendorff]
:
: Jason Orendorff [:jorendorff]
Mentors:
: 726411 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-02-10 15:58 PST by Jason Orendorff [:jorendorff]
Modified: 2012-03-02 06:19 PST (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v1 (1.34 KB, patch)
2012-02-10 16:07 PST, Jason Orendorff [:jorendorff]
jwalden+bmo: review+
Details | Diff | Splinter Review

Description Jason Orendorff [:jorendorff] 2012-02-10 15:58:39 PST
for (x of [,,]) {}

Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558
Comment 1 Jason Orendorff [:jorendorff] 2012-02-10 16:07:27 PST
Created attachment 596209 [details] [diff] [review]
v1
Comment 2 Jeff Walden [:Waldo] (remove +bmo to email) 2012-02-15 16:25:29 PST
Comment on attachment 596209 [details] [diff] [review]
v1

Review of attachment 596209 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/for-of/array-holes-6.js
@@ +1,1 @@
> +// for-of visits each hole in an array full of holes.

Add an indexed property to Array.prototype, and a separate one to Object.prototype, and check for them when for-ofing below?  Just to be sure.
Comment 3 Masatoshi Kimura [:emk] (use Splinter to ask me for review, see bugzil.la/1321953) 2012-02-15 22:16:00 PST
*** Bug 726411 has been marked as a duplicate of this bug. ***
Comment 4 Jason Orendorff [:jorendorff] 2012-02-25 13:31:07 PST
> Add an indexed property to Array.prototype, and a separate one to
> Object.prototype, and check for them when for-ofing below?  Just to be sure.

Added.
Comment 5 Jason Orendorff [:jorendorff] 2012-03-01 07:06:02 PST
The patch in bug 725168 fixed this bug automagically, so this check-in is just the tests.

https://hg.mozilla.org/integration/mozilla-inbound/rev/4d9810a2c2b5
Comment 6 Marco Bonardo [::mak] 2012-03-02 06:19:07 PST
https://hg.mozilla.org/mozilla-central/rev/4d9810a2c2b5

Note You need to log in before you can comment on or make changes to this bug.