Closed
Bug 702262
Opened 13 years ago
Closed 6 years ago
Array delete injects a hole but not marking array as non-simple
Categories
(Tamarin Graveyard :: Library, defect)
Tamarin Graveyard
Library
Tracking
(Not tracked)
RESOLVED
WONTFIX
People
(Reporter: pnkfelix, Unassigned)
References
Details
(In reply to Tamarin Bot from comment #35)
> changeset: 6717:2a58c781d85d
> user: Felix S Klock II <fklockii@adobe.com>
> summary: Bug 688486: state tracking array simpleness (r=lhansen).
>
> http://hg.mozilla.org/tamarin-redux/rev/2a58c781d85d
(In reply to Tamarin Bot from comment #36)
> changeset: 6718:ef9e442690e0
> user: Felix S Klock II <fklockii@adobe.com>
> summary: Bug 688486: mark arrays constructed via 'Array()' as simple
> (r=treilly, sr=lhansen).
>
> http://hg.mozilla.org/tamarin-redux/rev/ef9e442690e0
changeset 6718 injected a failure in the deep builds; the actual bug is really in changeset 6717, in my opinion.
var arr:Array = new Array();
arr[0] = "abc"; // arr.length == 1
arr[1] = "def"; // arr.length == 2
arr[2] = "ghi"; // arr.length == 3
AddTestCase("delete arr[2] again", true, delete arr[2]);
AddTestCase("arr[2]", undefined, arr[2]);
signals an assertion failure in ArrayObject::_getUintProperty,
AvmAssertMsg(value != atomNotFound, "hole in simple array");
Reporter | ||
Updated•13 years ago
|
Blocks: array-correctness
Reporter | ||
Comment 1•13 years ago
|
||
(you probably need to run the code from comment 0 with -Ojit to expose the described bug.)
Reporter | ||
Comment 2•13 years ago
|
||
I would have thought that the tests I've been running from Bug 693431 would have caught this. Need to investigate that after I post a fix for this.
Reporter | ||
Comment 3•13 years ago
|
||
(In reply to Felix S Klock II from comment #2)
> I would have thought that the tests I've been running from Bug 693431 would
> have caught this. Need to investigate that after I post a fix for this.
Ah its because the current patch on Bug 693431 is sorely lacking in type annotations, and so its not actually exercising the control flow paths that the jit goes through with the assertions.
A couple orthogonal work-items that spawn off from this:
1. put more assertions on the non-jitted paths.
2. expand or change the tests in Bug 693431 to include more type annotation heavy code.
Comment 4•13 years ago
|
||
changeset: 6727:007ca8d1a8f5
user: Felix S Klock II <fklockii@adobe.com>
summary: Bug 702262: delete must not yield simple array (r=fklockii).
http://hg.mozilla.org/tamarin-redux/rev/007ca8d1a8f5
Comment 5•6 years ago
|
||
Tamarin is a dead project now. Mass WONTFIX.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
Comment 6•6 years ago
|
||
Tamarin isn't maintained anymore. WONTFIX remaining bugs.
You need to log in
before you can comment on or make changes to this bug.
Description
•