"Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558" with for-of, Array, trailing holes

RESOLVED FIXED in mozilla13

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jorendorff, Assigned: jorendorff)

Tracking

Other Branch
mozilla13
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
for (x of [,,]) {}

Assertion failure: isDenseArray() && idx < getDenseArrayInitializedLength(), at ../jsobjinlines.h:558
(Assignee)

Comment 1

6 years ago
Created attachment 596209 [details] [diff] [review]
v1
Assignee: general → jorendorff
Attachment #596209 - Flags: review?(jwalden+bmo)
Comment on attachment 596209 [details] [diff] [review]
v1

Review of attachment 596209 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/for-of/array-holes-6.js
@@ +1,1 @@
> +// for-of visits each hole in an array full of holes.

Add an indexed property to Array.prototype, and a separate one to Object.prototype, and check for them when for-ofing below?  Just to be sure.
Attachment #596209 - Flags: review?(jwalden+bmo) → review+
Duplicate of this bug: 726411
(Assignee)

Comment 4

6 years ago
> Add an indexed property to Array.prototype, and a separate one to
> Object.prototype, and check for them when for-ofing below?  Just to be sure.

Added.
(Assignee)

Comment 5

6 years ago
The patch in bug 725168 fixed this bug automagically, so this check-in is just the tests.

https://hg.mozilla.org/integration/mozilla-inbound/rev/4d9810a2c2b5
https://hg.mozilla.org/mozilla-central/rev/4d9810a2c2b5
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13
You need to log in before you can comment on or make changes to this bug.