Closed Bug 560216 Opened 11 years ago Closed 11 years ago

"Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla2.0b7
Tracking Status
blocking2.0 --- final+

People

(Reporter: gkw, Assigned: Waldo)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

for (e in Function("\
  with({b:Object.defineProperty(this,\"x\",{set:yield})}) x\
")())
function () {}

asserts js debug shell on TM tip without -j at Assertion failure: (sprop)->slot != SPROP_INVALID_SLOT || !sprop->hasDefaultSetter(), at ../jsops.cpp:2278

autoBisecting soon...
autoBisect shows this is probably related to bug 430133:

The first bad revision is:
changeset:   36651:766a6b2e74e7
user:        Jeff Walden
date:        Fri Jun 05 12:56:45 2009 -0700
summary:     Bug 430133 - Implement ES3.1's Object.defineProperty and Object.defineProperties.  r=jorendorff
Blocks: 430133
OS: Linux → All
Hardware: x86 → All
Simpler:

Object.defineProperty(this,'x',{set:undefined}); x;
Basically we look up the sprop in some opcode in the interpreter (JSOP_NAME maybe; note this doesn't work for this.x or obj.member syntax), then we NATIVE_GET it, but that assumes it can't be an accessor but have neither getter nor setter.  Easy diagnosis, less immediately obvious the exact way to fix, but shouldn't be much trouble.
Waldo says assign to him on IRC..
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
blocking2.0: --- → final+
Comment #0 has further morphed to Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),
Summary: "Assertion failure: (sprop)->slot != SPROP_INVALID_SLOT || !sprop->hasDefaultSetter(), at ../jsops.cpp" → "Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),"
Attached patch Patch and testSplinter Review
This seems like the simplest fix.  { get: undefined, set: undefined } was a bad mistake in the spec.
Attachment #479612 - Flags: review?(dvander)
Attachment #479612 - Flags: review?(dvander) → review+
http://hg.mozilla.org/tracemonkey/rev/a307ab9638b4
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla2.0b7
http://hg.mozilla.org/mozilla-central/rev/a307ab9638b4
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.