600138 - TM: "Assertion failure: &shape->methodObject() == &vp->toObject(),"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function z() {
    this.a = function () {}
    this.a = this
    Object.defineProperty(this, "a", ({}))
}
for (e in [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]) {
    new z()
}

asserts js debug shell on TM changeset 54700fad8cf9 with -j at Assertion failure: &shape->methodObject() == &vp->toObject(),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   36651:766a6b2e74e7
user:        Jeff Walden
date:        Fri Jun 05 12:56:45 2009 -0700
summary:     Bug 430133 - Implement ES3.1's Object.defineProperty and Object.defineProperties.  r=jorendorff

Comment 2

[Brendan Eich [:brendan]]

Dup of, or related to, bug 561359 .

/be

Comment 3

[Jesse Ruderman]

The first good revision is:
changeset:   33c58d16d911
user:        Jason Orendorff
date:        Fri Jan 14 16:18:53 2011 -0600
summary:     Bug 559653 - Record assignment before the interpreter goes, mostly. This reduces record_SetPropHit to a narrower callback, record_AddProperty. r=brendan.

Comment 4

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929