"Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),"

RESOLVED FIXED in mozilla2.0b7

Status

()

--
critical
RESOLVED FIXED
9 years ago
8 years ago

People

(Reporter: gkw, Assigned: Waldo)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla2.0b7
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 final+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
for (e in Function("\
  with({b:Object.defineProperty(this,\"x\",{set:yield})}) x\
")())
function () {}

asserts js debug shell on TM tip without -j at Assertion failure: (sprop)->slot != SPROP_INVALID_SLOT || !sprop->hasDefaultSetter(), at ../jsops.cpp:2278

autoBisecting soon...
(Reporter)

Comment 1

9 years ago
autoBisect shows this is probably related to bug 430133:

The first bad revision is:
changeset:   36651:766a6b2e74e7
user:        Jeff Walden
date:        Fri Jun 05 12:56:45 2009 -0700
summary:     Bug 430133 - Implement ES3.1's Object.defineProperty and Object.defineProperties.  r=jorendorff
Blocks: 430133
OS: Linux → All
Hardware: x86 → All

Comment 2

9 years ago
Simpler:

Object.defineProperty(this,'x',{set:undefined}); x;
(Assignee)

Comment 3

9 years ago
Basically we look up the sprop in some opcode in the interpreter (JSOP_NAME maybe; note this doesn't work for this.x or obj.member syntax), then we NATIVE_GET it, but that assumes it can't be an accessor but have neither getter nor setter.  Easy diagnosis, less immediately obvious the exact way to fix, but shouldn't be much trouble.
(Reporter)

Comment 4

9 years ago
Waldo says assign to him on IRC..
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED

Updated

9 years ago
blocking2.0: --- → final+
(Reporter)

Comment 5

8 years ago
Comment #0 has further morphed to Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),
Summary: "Assertion failure: (sprop)->slot != SPROP_INVALID_SLOT || !sprop->hasDefaultSetter(), at ../jsops.cpp" → "Assertion failure: (shape)->slot != SHAPE_INVALID_SLOT || !shape->hasDefaultSetter(),"
(Assignee)

Comment 6

8 years ago
Created attachment 479612 [details] [diff] [review]
Patch and test

This seems like the simplest fix.  { get: undefined, set: undefined } was a bad mistake in the spec.
Attachment #479612 - Flags: review?(dvander)
Attachment #479612 - Flags: review?(dvander) → review+
(Assignee)

Comment 7

8 years ago
http://hg.mozilla.org/tracemonkey/rev/a307ab9638b4
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla2.0b7

Comment 8

8 years ago
http://hg.mozilla.org/mozilla-central/rev/a307ab9638b4
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.