Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-03 02:25:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1057582 - Remove a bogus assert. r=bhackett

Browse Source
This commit is contained in:
Jan de Mooij 2014-08-26 10:14:06 +02:00
parent 38fd3fb707
commit f980f5fb99
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/src/jit-test/tests/ion/bug1057582.js Normal file
View File

@ -0,0 +1,10 @@
Object.defineProperty(Object.prototype, "0", {configurable: true});
delete Object.prototype[0];
function makeArray() {
var arr = [];
for (var i = 0; i < 10; i++)
arr.push(true);
return arr;
}
makeArray();

1
js/src/jit/VMFunctions.cpp
View File

@ -402,7 +402,6 @@ ArrayPushDense(JSContext *cx, HandleObject obj, HandleValue v, uint32_t *length)
{
JS_ASSERT(obj->is<ArrayObject>());
JS_ASSERT(obj->as<ArrayObject>().lengthIsWritable());
JS_ASSERT(!ObjectMayHaveExtraIndexedProperties(obj));
uint32_t idx = obj->as<ArrayObject>().length();
JSObject::EnsureDenseResult result = obj->ensureDenseElements(cx, idx, 1);