366396 - "Assertion failure: !SPROP_HAS_STUB_GETTER(sprop)" with setter and %=

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> this.__defineSetter__("x", function() {}); x %= 5;
Assertion failure: !SPROP_HAS_STUB_GETTER(sprop), at jsobj.c:3427

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

The JSMSG_GETTER_ONLY error makes for a big difference between js_NativeGet and js_NativeSet: the former must handle the stub case before calling SPROP_GET (which now requires a non-stub [null] getter), whether or not there's a slot allocated.  OTOH, js_NativeSet knows that if there's no slot and no setter, SPROP_SET will throw before it might dereference a null (stub) setter.

/be

Comment 2

[Brendan Eich [:brendan]]

Fixed on trunk (with slightly improved comment):

js/src/jsobj.c rev 3.319

/be

Comment 3

[Brendan Eich [:brendan]]

This was another regression from bug 365851.

/be

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 250927 [details] [diff] [review]
fix

Yikes, this is needed on the branches, stat!

/be

Comment 6

[Jay Patel [:jay]]

Comment on attachment 250927 [details] [diff] [review]
fix

Approved for both branches, a=jay for drivers.

Comment 7

[Brendan Eich [:brendan]]

Fixed on 1.8 and 1.8 branches:

js/src/jsobj.c rev 3.208.2.47
js/src/jsscope.h rev 3.38.4.2

js/src/jsobj.c rev 3.208.2.12.2.21
js/src/jsscope.h rev 3.38.12.1

/be

Comment 8

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/GetSet/regress-366396.js,v  <--  regress-366396.js
initial revision: 1.1

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.0, 1.8.1, 1.9.0 2007-01-23 win/mac*/linux