mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-31 14:15:30 +00:00
Remove bogus assertions in the tracer and in ArrayCompPushImpl helper function. Bug 630377, r=brendan.
--HG-- extra : rebase_source : 1ed9f873b630f7078f275846d95fbd68b4daeabe
This commit is contained in:
parent
ed7507ebd4
commit
7032e92ee5
7
js/src/jit-test/tests/basic/bug630377.js
Normal file
7
js/src/jit-test/tests/basic/bug630377.js
Normal file
@ -0,0 +1,7 @@
|
||||
var a = [];
|
||||
for (var i = 0; i < RUNLOOP; i++)
|
||||
a[i] = 0;
|
||||
var b = #1=[x === "0" && (#1#.slow = 1) for (x in a)];
|
||||
assertEq(b[0], 1);
|
||||
for (var i = 1; i < RUNLOOP; i++)
|
||||
assertEq(b[i], false);
|
@ -2059,28 +2059,34 @@ array_push1_dense(JSContext* cx, JSObject* obj, const Value &v, Value *rval)
|
||||
JS_ALWAYS_INLINE JSBool
|
||||
ArrayCompPushImpl(JSContext *cx, JSObject *obj, const Value &v)
|
||||
{
|
||||
uint32 length = obj->getArrayLength();
|
||||
if (obj->isSlowArray()) {
|
||||
/* This can happen in one evil case. See bug 630377. */
|
||||
jsid id;
|
||||
return js_IndexToId(cx, length, &id) &&
|
||||
js_DefineProperty(cx, obj, id, &v, NULL, NULL, JSPROP_ENUMERATE);
|
||||
}
|
||||
|
||||
JS_ASSERT(obj->isDenseArray());
|
||||
uint32_t length = obj->getArrayLength();
|
||||
JS_ASSERT(length <= obj->getDenseArrayCapacity());
|
||||
|
||||
if (length == obj->getDenseArrayCapacity()) {
|
||||
if (length > JS_ARGS_LENGTH_MAX) {
|
||||
JS_ReportErrorNumberUC(cx, js_GetErrorMessage, NULL,
|
||||
JSMSG_ARRAY_INIT_TOO_BIG);
|
||||
return JS_FALSE;
|
||||
return false;
|
||||
}
|
||||
|
||||
/*
|
||||
* Array comprehension cannot add holes to the array and never leaks
|
||||
* the array before it is fully initialized. So we can use ensureSlots
|
||||
* instead of ensureDenseArrayElements.
|
||||
* An array comprehension cannot add holes to the array. So we can use
|
||||
* ensureSlots instead of ensureDenseArrayElements.
|
||||
*/
|
||||
if (!obj->ensureSlots(cx, length + 1))
|
||||
return false;
|
||||
}
|
||||
obj->setArrayLength(length + 1);
|
||||
obj->setDenseArrayElement(length, v);
|
||||
return JS_TRUE;
|
||||
return true;
|
||||
}
|
||||
|
||||
JSBool
|
||||
|
@ -16309,7 +16309,6 @@ TraceRecorder::record_JSOP_ARRAYPUSH()
|
||||
JS_ASSERT(cx->fp()->slots() + slot < cx->regs->sp - 1);
|
||||
Value &arrayval = cx->fp()->slots()[slot];
|
||||
JS_ASSERT(arrayval.isObject());
|
||||
JS_ASSERT(arrayval.toObject().isDenseArray());
|
||||
LIns *array_ins = get(&arrayval);
|
||||
Value &elt = stackval(-1);
|
||||
LIns *elt_ins = box_value_for_native_call(elt, get(&elt));
|
||||
|
@ -32,4 +32,5 @@ script regress-627984-4.js
|
||||
script regress-627984-5.js
|
||||
script regress-627984-6.js
|
||||
script regress-627984-7.js
|
||||
script regress-630377.js
|
||||
script regress-631723.js
|
||||
|
11
js/src/tests/js1_8_5/extensions/regress-630377.js
Normal file
11
js/src/tests/js1_8_5/extensions/regress-630377.js
Normal file
@ -0,0 +1,11 @@
|
||||
// Any copyright is dedicated to the Public Domain.
|
||||
// http://creativecommons.org/licenses/publicdomain/
|
||||
|
||||
function f(x) {
|
||||
x.q = 1;
|
||||
}
|
||||
var a = #1=[f(#1#) for (i in [0])];
|
||||
assertEq(a.q, 1);
|
||||
assertEq(a[0], void 0);
|
||||
|
||||
reportCompare(0, 0, 'ok');
|
Loading…
Reference in New Issue
Block a user