/* * If rval is a hole, do not call OBJ_SET_PROPERTY. In this case, * obj must be an array, so if the current op is the last element * initialiser, set the array length to one greater than id. */ if (rval == JSVAL_HOLE) { JS_ASSERT(OBJ_IS_ARRAY(cx, obj)); JS_ASSERT(JSID_IS_INT(id)); JS_ASSERT((jsuint) JSID_TO_INT(id) < ARRAY_INIT_LIMIT); if ((JSOp) regs.pc[JSOP_INITELEM_LENGTH] == JSOP_ENDINIT && !js_SetLengthProperty(cx, obj, (jsuint) (JSID_TO_INT(id) + 1))) { goto error; } } else { if (!OBJ_SET_PROPERTY(cx, obj, id, &rval)) goto error; } regs.sp -= 2; END_CASE(JSOP_INITELEM) Looks to me like if the last element is a hole and we've set a trap on JSOP_ENDINIT, we won't set the length of the array, so it'll be a zero-length array when we're done here, I think. Can't hit this now, tho, because we don't emit JSOP_NEWINIT for array literals, but we should once bug 473096 is fixed, albeit only for super-large array literals.

So should this bug depend on bug 473096 rather than block it? /be

Sooth! Fixed in the interim since filing in another bug, duping appropriately...