Bug 1006065 - Remove bogus assert in ArraySpliceDense and add a testcase. r=h4writer, a=sledru
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 07 May 2014 12:50:07 +0200
changeset 199113 24b3df4c5810ed4100bb26cbdc8731ced5349cb5
parent 199112 dceb849a2d71f639e37bd7a97ad999ce80c346e8
child 199114 dd74b8815bbc15259a5af9a63dc70dc9eae4d3fc
push id3624
push userasasaki@mozilla.com
push dateMon, 09 Jun 2014 21:49:01 +0000
treeherdermozilla-beta@b1a5da15899a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer, sledru
bugs1006065
milestone31.0a2
Bug 1006065 - Remove bogus assert in ArraySpliceDense and add a testcase. r=h4writer, a=sledru
js/src/jit-test/tests/ion/array-splice.js
js/src/jit/VMFunctions.cpp
--- a/js/src/jit-test/tests/ion/array-splice.js
+++ b/js/src/jit-test/tests/ion/array-splice.js
@@ -20,8 +20,18 @@ function test2() {
     for (var i=0; i<100; i++)
 	arr.push(i);
     for (var i=0; i<40; i++)
 	arr.splice(0, 2);
     assertEq(arr.length, 20);
     assertEq(arr[0], 80);
 }
 test2();
+
+function testNonArray() {
+    for (var i=0; i<10; i++) {
+	var o = {splice:[].splice, 0:"a", 1:"b", 2:"c", length:3};
+	o.splice(0, 2);
+	assertEq(o.length, 1);
+	assertEq(o[0], "c");
+    }
+}
+testNonArray();
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -360,18 +360,16 @@ NewInitObjectWithClassPrototype(JSContex
     obj->setType(templateObject->type());
 
     return obj;
 }
 
 bool
 ArraySpliceDense(JSContext *cx, HandleObject obj, uint32_t start, uint32_t deleteCount)
 {
-    JS_ASSERT(obj->is<ArrayObject>());
-
     JS::AutoValueArray<4> argv(cx);
     argv[0].setUndefined();
     argv[1].setObject(*obj);
     argv[2].set(Int32Value(start));
     argv[3].set(Int32Value(deleteCount));
 
     return js::array_splice_impl(cx, 2, argv.begin(), false);
 }