560216 - "Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (e in Function("\
  with({b:Object.defineProperty(this,\"x\",{set:yield})}) x\
")())
function () {}

asserts js debug shell on TM tip without -j at Assertion failure: (sprop)->slot != SPROP_INVALID_SLOT || !sprop->hasDefaultSetter(), at ../jsops.cpp:2278

autoBisecting soon...

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 430133:

The first bad revision is:
changeset:   36651:766a6b2e74e7
user:        Jeff Walden
date:        Fri Jun 05 12:56:45 2009 -0700
summary:     Bug 430133 - Implement ES3.1's Object.defineProperty and Object.defineProperties.  r=jorendorff

Comment 2

[Jesse Ruderman]

Simpler:

Object.defineProperty(this,'x',{set:undefined}); x;

Comment 3

[Jeff Walden [:Waldo]]

Basically we look up the sprop in some opcode in the interpreter (JSOP_NAME maybe; note this doesn't work for this.x or obj.member syntax), then we NATIVE_GET it, but that assumes it can't be an accessor but have neither getter nor setter.  Easy diagnosis, less immediately obvious the exact way to fix, but shouldn't be much trouble.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Waldo says assign to him on IRC..

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment #0 has further morphed to Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),

Comment 6

[Jeff Walden [:Waldo]]

Attachment: Patch and test

This seems like the simplest fix.  { get: undefined, set: undefined } was a bad mistake in the spec.

Comment 7

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/a307ab9638b4

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/a307ab9638b4