585407 - TM: "Assertion failure: &sprop->methodObject() == &vp->toObject(),"

Status: RESOLVED DUPLICATE of bug 581785

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function z() {
    this.e = function() {};
    this.e = /x/;
    Object.defineProperty(this, "e", {})
}
for (b in [0, 0, 0, 0]) {
    new z()
}

asserts js debug shell on TM changeset 3381eda6b5ae with -j at Assertion failure: &sprop->methodObject() == &vp->toObject(), at ../jsobj.cpp:4662

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   37732:6a3c15f34a50
user:        Jeff Walden
date:        Tue Jan 26 18:41:30 2010 -0800
summary:     Bug 540985 - Regression in Peacekeeper string benchmarks due to regexp literals no longer tracing.  A prototype of this patch was by bz.  r=igor

Comment 2

[Jeff Walden [:Waldo]]

This looks very very very much like a duplicate of bug 581785, particularly if I rapid-tab between this report and that one and see that the only difference (after renaming) is what's assigned in the middle statement inside the function.  I'm going to mark it as such, and per standard practice when the fix for that bug lands the person doing so should check this bug too to make sure it really was a dup.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 581785).