585257 - "Assertion failure: obj == obj2,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

__proto__=evalcx('')
Function("__defineSetter__(\"__proto__\",function(){})")()

asserts js debug shell on TM changeset 785488c82d41 without -j at Assertion failure: obj == obj2, at ../jsapi.cpp:3502

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   44269:3aaaa21012c8
user:        Jason Orendorff
date:        Wed Jun 23 16:35:10 2010 -0500
summary:     Bug 563099 - Compartments and wrappers API. r=gal.

Comment 2

[Jason Orendorff [:jorendorff]]

To trigger this bug, (a) make an object whose prototype is a proxy; (b) call JS_GetPropertyDescriptorById on that object. __proto__ and the global object are not necessarily involved:

Object.create(evalcx('')).__defineSetter__('toString', function(){});

I think the assertion is just bogus.

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This was checked in to TM..

http://hg.mozilla.org/tracemonkey/rev/569d6bc63ce2

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/569d6bc63ce2

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-585257.js.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.