593933 - "Assertion failure: !(attrs & (JSPROP_GETTER | JSPROP_SETTER)),"

Status: RESOLVED DUPLICATE of bug 559912

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

new(function() {
    Object.defineProperty(this, "d", ({
        set: Object.getOwnPropertyNames
    }))
    this.d = function() {}
})()

asserts js debug shell on TM changeset 7ef38f42e7c8 without -m nor -j at Assertion failure: !(attrs & (JSPROP_GETTER | JSPROP_SETTER)),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   52840:a94f533cf703
user:        Brendan Eich
date:        Tue Aug 31 16:45:34 2010 -0700
summary:     Wrong behavior setting existing properties to joined function object values (592412, r=jorendorff).

Comment 2

[Andreas Gal :gal]

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x0000000100177748 in JS_Assert (s=0x10028f820 "!(attrs & (JSPROP_GETTER | JSPROP_SETTER))", file=0x10028ea8b "../jsobj.cpp", ln=5072) at ../jsutil.cpp:80
80	    *((int *) NULL) = 0;  /* To continue from here in GDB: "return" then "continue". */
(gdb) bt
#0  0x0000000100177748 in JS_Assert (s=0x10028f820 "!(attrs & (JSPROP_GETTER | JSPROP_SETTER))", file=0x10028ea8b "../jsobj.cpp", ln=5072) at ../jsutil.cpp:80
#1  0x00000001000db5ca in js_SetPropertyHelper (cx=0x1007129b0, obj=0x101603780, id={asBits = 4298612816}, defineHow=5, vp=0x7fff5fbfe360) at ../jsobj.cpp:5072
#2  0x00000001000ac244 in js::Interpret (cx=0x1007129b0, entryFrame=0x101000100, inlineCallCount=1) at ../jsinterp.cpp:4269
#3  0x00000001000c084e in js::RunScript (cx=0x1007129b0, script=0x10071db60, fun=0x0, scopeChain=0x101603000) at jsinterp.cpp:468
#4  0x00000001000c0f82 in js::Execute (cx=0x1007129b0, chain=0x101603000, script=0x10071db60, down=0x0, flags=0, result=0x7fff5fbff700) at jsinterp.cpp:790
#5  0x0000000100017b86 in JS_ExecuteScript (cx=0x1007129b0, obj=0x101603000, script=0x10071db60, rval=0x7fff5fbff700) at ../jsapi.cpp:4649
#6  0x000000010000ce1e in Process (cx=0x1007129b0, obj=0x101603000, filename=0x0, forceTTY=0) at ../../shell/js.cpp:535
#7  0x000000010000d702 in ProcessArgs (cx=0x1007129b0, obj=0x101603000, argv=0x7fff5fbff958, argc=0) at ../../shell/js.cpp:862
#8  0x000000010000d7ea in shell (cx=0x1007129b0, argc=0, argv=0x7fff5fbff958, envp=0x7fff5fbff960) at ../../shell/js.cpp:5203
#9  0x000000010000d8e6 in main (argc=0, argv=0x7fff5fbff958, envp=0x7fff5fbff960) at ../../shell/js.cpp:5299

Comment 3

[Robert Sayre]

Still asserts.