From 6f7d355335f20abf77394382af43e5ba6034ff32 Mon Sep 17 00:00:00 2001 From: Jeff Walden Date: Mon, 23 Mar 2009 00:26:52 -0700 Subject: [PATCH] Bug 484750 - Assertion failure: newlen == 0 || obj->dslots[newlen - 1] != JSVAL_HOLE, at ../jsarray.cpp. Modify an assertion to properly handle intentional fenceposting behavior where we copy 0 elements to the end of an array -- can't assert that the end of the array isn't a hole in this case because we're intentionally not changing the array from what it was before -- demonstrated by [,].splice(1). r=me as obvious from debugging the testcase --- js/src/jsarray.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp index 51e37c5dd56f..74709635518f 100644 --- a/js/src/jsarray.cpp +++ b/js/src/jsarray.cpp @@ -1600,7 +1600,7 @@ InitArrayElements(JSContext *cx, JSObject *obj, jsuint start, jsuint count, jsva JS_ASSERT(count < size_t(-1) / sizeof(jsval)); memcpy(obj->dslots + start, vector, sizeof(jsval) * count); - JS_ASSERT(newlen == 0 || obj->dslots[newlen - 1] != JSVAL_HOLE); + JS_ASSERT_IF(count != 0, obj->dslots[newlen - 1] != JSVAL_HOLE); return JS_TRUE; }