Bug 438415 - Assertion failure: *vp != JSVAL_HOLE, r=shaver, r=brendan
This commit is contained in:
@@ -2098,23 +2098,16 @@ array_pop(JSContext *cx, uintN argc, jsval *vp)
|
||||
if (!obj)
|
||||
return JS_FALSE;
|
||||
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
|
||||
*vp = JSVAL_VOID;
|
||||
index = obj->fslots[JSSLOT_ARRAY_LENGTH];
|
||||
if (index == 0)
|
||||
if (index == 0) {
|
||||
*vp = JSVAL_VOID;
|
||||
return JS_TRUE;
|
||||
index--;
|
||||
if (index < ARRAY_DENSE_LENGTH(obj)) {
|
||||
*vp = obj->dslots[index];
|
||||
JS_ASSERT(*vp != JSVAL_HOLE);
|
||||
if (index == 0) {
|
||||
JS_free(cx, obj->dslots - 1);
|
||||
obj->dslots = NULL;
|
||||
} else {
|
||||
ARRAY_SET_DENSE_LENGTH(obj, index);
|
||||
}
|
||||
obj->fslots[JSSLOT_ARRAY_COUNT]--;
|
||||
}
|
||||
|
||||
index--;
|
||||
if (!GetArrayElement(cx, obj, index, &hole, vp))
|
||||
return JS_FALSE;
|
||||
if (!hole && !DeleteArrayElement(cx, obj, index))
|
||||
return JS_FALSE;
|
||||
obj->fslots[JSSLOT_ARRAY_LENGTH] = index;
|
||||
return JS_TRUE;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user