Closed
Bug 699674
Opened 13 years ago
Closed 13 years ago
"Assertion failure: length <= INT32_MAX,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
(deleted),
text/plain
|
Details |
Array(24)
for(v in(Array(2440598491))){}
asserts js debug shell on JM changeset 6dc7901db1d6 without any CLI flags at Assertion failure: length <= INT32_MAX,
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 79619:daa488a2e663
user: Brian Hackett
date: Thu Nov 03 09:57:12 2011 -0700
summary: Add cache for constructing new objects from the VM, bug 699446.
Comment 1•13 years ago
|
||
WFM on tip. The named cset used setDenseArrayLength instead of setArrayLength in one place (the assert is actually bogus, since the type will already have been marked as having unknown properties).
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Comment 2•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•