Bug 1206265 - Add missing increment operations, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Sat, 19 Sep 2015 12:44:39 -0600
changeset 297734 71e34d39c5c5cb6178610796dfc9b5b382856076
parent 297733 9bdb6d48a34e1bbf0aaf468e44e71544e26adf7d
child 297735 14be11ac3fd70d3387e614f5697b33c6e166355f
push id962
push userjlund@mozilla.com
push dateFri, 04 Dec 2015 23:28:54 +0000
treeherdermozilla-release@23a2d286e80f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1206265
milestone43.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1206265 - Add missing increment operations, r=jandem.
js/src/jit-test/tests/basic/bug1206265.js
js/src/vm/UnboxedObject-inl.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1206265.js
@@ -0,0 +1,8 @@
+x = [
+    objectEmulatingUndefined(),
+    function() {}
+];
+x.forEach(function() {});
+this.x.sort(function() {});
+assertEq(x[0] instanceof Function, false);
+assertEq(x[1] instanceof Function, true);
--- a/js/src/vm/UnboxedObject-inl.h
+++ b/js/src/vm/UnboxedObject-inl.h
@@ -497,20 +497,20 @@ SetOrExtendBoxedOrUnboxedDenseElements(E
     // Overwrite any existing elements covered by the new range. If we fail
     // after this point due to some incompatible type being written to the
     // object's elements, afterwards the contents will be different from when
     // we started. The caller must retry the operation using a generic path,
     // which will overwrite the already-modified elements as well as the ones
     // that were left alone.
     size_t i = 0;
     if (updateTypes == ShouldUpdateTypes::DontUpdate) {
-        for (size_t j = start; i < count && j < oldInitlen; i++)
+        for (size_t j = start; i < count && j < oldInitlen; i++, j++)
             nobj->setElementNoTypeChangeSpecific<Type>(j, vp[i]);
     } else {
-        for (size_t j = start; i < count && j < oldInitlen; i++) {
+        for (size_t j = start; i < count && j < oldInitlen; i++, j++) {
             if (!nobj->setElementSpecific<Type>(cx, j, vp[i]))
                 return DenseElementResult::Incomplete;
         }
     }
 
     if (i != count) {
         obj->as<UnboxedArrayObject>().setInitializedLength(start + count);
         if (updateTypes == ShouldUpdateTypes::DontUpdate) {