Bug 1300193 - Make existing assertion that no longer holds more flexible. r=jandem
authorLeo Gaspard <leo@gaspard.io>
Fri, 02 Sep 2016 15:47:57 -0700
changeset 312938 ba853a36a9737bd58f90a042a1bc56f55938a21f
parent 312937 cbe972bcc9ffa144f78e61a3c7c577db0c6e7442
child 312939 cd249dba87c2660f93409a99ca9296386d230345
push id30665
push usercbook@mozilla.com
push dateWed, 07 Sep 2016 15:20:43 +0000
treeherdermozilla-central@95acb9299faf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1300193
milestone51.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1300193 - Make existing assertion that no longer holds more flexible. r=jandem
js/src/jit-test/tests/arrays/reverse-frozen.js
js/src/vm/NativeObject-inl.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/reverse-frozen.js
@@ -0,0 +1,6 @@
+// |jit-test| error: TypeError
+
+x = [0];
+x.length = 9;
+Object.freeze(x);
+x.reverse();
--- a/js/src/vm/NativeObject-inl.h
+++ b/js/src/vm/NativeObject-inl.h
@@ -156,17 +156,17 @@ NativeObject::extendDenseElements(Exclus
     MOZ_ASSERT(!denseElementsAreCopyOnWrite());
 
     /*
      * Don't grow elements for non-extensible objects or watched objects. Dense
      * elements can be added/written with no extensible or watchpoint checks as
      * long as there is capacity for them.
      */
     if (!nonProxyIsExtensible() || watched()) {
-        MOZ_ASSERT(getDenseCapacity() == 0);
+        MOZ_ASSERT(getDenseCapacity() == 0 || (!watched() && getElementsHeader()->isFrozen()));
         return DenseElementResult::Incomplete;
     }
 
     /*
      * Don't grow elements for objects which already have sparse indexes.
      * This avoids needing to count non-hole elements in willBeSparseElements
      * every time a new index is added.
      */