560221 - JM: "Assertion failure: sprop->writable(), at ../jsops.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
  (function() {
    (Object.defineProperty(this, "x", ({
      set: function() {}
    })))
  })()
} catch(e) {}
for (var a = 0; a < 4; a++) {
  x = 7
}

asserts js debug shell on TM tip without -j at Assertion failure: sprop->writable(), at ../jsops.cpp:1697

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Whoops this is a JM bug... autoBisect coming up...

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This is fixed on TM, looks like I'll have to do another merge shortly.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> This is fixed on TM, looks like I'll have to do another merge shortly.

Oh great, so I can move autoBisect on to another bug. :)

Comment 4

[Jason Orendorff [:jorendorff]]

What needs to happen in this bug? Is it worth adding this as a test?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #4)
> What needs to happen in this bug? Is it worth adding this as a test?

Yes, I would think.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

We've merged with TM so this is fixed (pushed a test case for good measure).

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #6)
> We've merged with TM so this is fixed (pushed a test case for good measure).

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/aa3609bf42d9

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug560221.js.