Bug 438415 - Assertion failure: *vp != JSVAL_HOLE, r=shaver, r=brendan

This commit is contained in:
2008-07-01 12:47:09 -07:00
parent f412ce8864
commit c4707cae81

View File

@@ -2098,23 +2098,16 @@ array_pop(JSContext *cx, uintN argc, jsval *vp)
if (!obj)
return JS_FALSE;
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
*vp = JSVAL_VOID;
index = obj->fslots[JSSLOT_ARRAY_LENGTH];
if (index == 0)
if (index == 0) {
*vp = JSVAL_VOID;
return JS_TRUE;
index--;
if (index < ARRAY_DENSE_LENGTH(obj)) {
*vp = obj->dslots[index];
JS_ASSERT(*vp != JSVAL_HOLE);
if (index == 0) {
JS_free(cx, obj->dslots - 1);
obj->dslots = NULL;
} else {
ARRAY_SET_DENSE_LENGTH(obj, index);
}
obj->fslots[JSSLOT_ARRAY_COUNT]--;
}
index--;
if (!GetArrayElement(cx, obj, index, &hole, vp))
return JS_FALSE;
if (!hole && !DeleteArrayElement(cx, obj, index))
return JS_FALSE;
obj->fslots[JSSLOT_ARRAY_LENGTH] = index;
return JS_TRUE;
}