548276 - "Assertion failure: HAS_FUNCTION_CLASS(funobj), at ../jsdbgapi.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

__defineSetter__("x", function() {});
(function() {
  this.watch("x", function() {})
})();
__defineSetter__("x", /a/)


asserts js debug shell on TM tip without -j at Assertion failure: HAS_FUNCTION_CLASS(funobj), at ../jsdbgapi.cpp:776

To reproduce this, pass the testcase as a CLI argument. (e.g. ./js -j testcase.js)

autoBisect shows this is probably related to bug 547314:

The first bad revision is:
changeset:   38505:65eeef03da7c
user:        Andreas Gal
date:        Mon Feb 22 16:30:22 2010 -0800
summary:     Introduce ObjectOps for typeOf and make trace a mandatory ObjectOp (547314, r=brendan).

Comment 1

[Andreas Gal :gal]

I looked into this yesterday and forgot to update the bug. We allow callable objects as setters/getters, so the code should just return false if !HAS_FUNCTION_CLASS() instead of asserting.

Comment 2

[Andreas Gal :gal]

Attachment: patch

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v1

Yay for assertions.

Comment 4

[Jeff Walden [:Waldo]]

Comment on attachment 428943 [details] [diff] [review]
v1

*stamp*

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 428940 [details] [diff] [review]
patch

jorendorff's patch is the same as this - with a test. Marking obsolete to clear up future "discover patches with no review flags set" endeavours.

Comment 6

[Andreas Gal :gal]

Thanks Gary.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/tracemonkey/rev/3ce8e932f694

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3ce8e932f694

Comment 9

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-548276.js.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.