569774 - "Assertion failure: initialVarObj->map->ops->defineProperty == js_DefineProperty,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = Proxy.create((function () {}), (evalcx('')))
try {
    (function () {
        ((let(e = eval) e).call(x, ("\"\"")))
    })()
} catch (e) {}

asserts js debug shell on TM tip without -j at Assertion failure: initialVarObj->map->ops->defineProperty == js_DefineProperty, at ../jsinterp.cpp:811

Assuming related to harmony:proxies.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   44269:3aaaa21012c8
user:        Jason Orendorff
date:        Wed Jun 23 16:35:10 2010 -0500
summary:     Bug 563099 - Compartments and wrappers API. r=gal.

Bug 563099 seems to have fixed the assert.

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929