Status

()

defect
P2
critical
VERIFIED FIXED
9 years ago
7 years ago

People

(Reporter: gkw, Assigned: brendan)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

Trunk
mozilla2.0b7
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

try {
  (function() {
    __defineSetter__("x", Math.sin);
  } ());
} catch(e) {}
function::x =
Proxy.createFunction(function() {
  return {
    get: function() {
      return [];
    }
  };
} (),
function() {});

asserts js debug shell on TM changeset dfcf5611ce02 without -m or -j at Assertion failure: 0,
blocking2.0: --- → ?
Posted patch fixSplinter Review
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #476681 - Flags: review?(igor)
OS: Mac OS X → All
Priority: -- → P2
Hardware: x86 → All
Target Milestone: --- → mozilla2.0b7
Not sure this is a regression, it may date to E4X and the function namespace. Proxy.createFunction throws and we try to decompile the function::x = ... (JSOP_SETXMLNAME), but the decompiler never supported the necessary LHS -> RHS transformation, which the patch adds. I bet there is a testcase that does not depend on proxies.

/be
Attachment #476681 - Flags: review?(igor) → review+
http://hg.mozilla.org/tracemonkey/rev/3559d9fded5f

/be
Whiteboard: fixed-in-tracemonkey
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   42437:4dd9be00049c
user:        Andreas Gal
date:        Tue May 18 19:21:43 2010 -0700
summary:     Implement ES Harmony Proxies (bug 546590, r=mrbkap).

... but as mentioned this might not be accurate..
http://hg.mozilla.org/mozilla-central/rev/3559d9fded5f
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
blocking2.0: ? → betaN+
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-597870.js.
Flags: in-testsuite+
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.