560277 - Crash [@ JSObject::getParent] or [@ js_WrapWatchedSetter] or [@ js_GetClassPrototype]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

watch("x", function () {})
Object.defineProperty(this, "x", ({
    set: this.e
}))

crashes js debug shell on TM tip without -j at JSObject::getParent and crashes js opt shell on TM tip without -j at js_WrapWatchedSetter

s-s because I could make this crash an opt nightly Firefox build.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> s-s because I could make this crash an opt nightly Firefox build.

bp-9241175a-54e4-4911-80b1-91ade2100419

Comment 2

[Jesse Ruderman]

Simpler, replacing the expression |this.e| with its value |undefined|:

watch("x", function () {})
Object.defineProperty(this, "x", ({
   set: undefined
}))

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 430133:

The first bad revision is:
changeset:   36651:766a6b2e74e7
user:        Jeff Walden
date:        Fri Jun 05 12:56:45 2009 -0700
summary:     Bug 430133 - Implement ES3.1's Object.defineProperty and Object.defineProperties.  r=jorendorff

Comment 4

[Jeff Walden [:Waldo]]

(Dagnabbit, both of you, stop mid-airing with me!  :-P )

Comment 5

[Jeff Walden [:Waldo]]

This is just an assumption that JSPROP_SETTER implies !!setter, and the crashes (in different locations due to the unspecified ordering of evaluation of arguments) are all small-fixed-offset-from-null dereferences.

Comment 6

[Jeff Walden [:Waldo]]

Attachment: Patch

Comment 7

[Andreas Gal :gal]

Gary asked that I land this.

http://hg.mozilla.org/tracemonkey/rev/d7762651d0d5

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/d7762651d0d5

Comment 9

[Daniel Veditz [:dveditz] back 2026-04-08]

(In reply to comment #3)
> The first bad revision is:
> changeset:   36651:766a6b2e74e7
> date:        Fri Jun 05 12:56:45 2009 -0700

It would be much less confusing when tracking down which bugs affect which branches to use pushlog dates rather than the changeset dates that come from the developer's tree. June 5 2009 should have impacted 1.9.2, but the actual push of Tue Dec 29 11:01:24 2009 -0800 was well after that branch was cut.

Comment 10

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/0114382223da

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.