624417 - Crash [@ JSObject::allocSlot] or "Assertion failure: JSVAL_IS_DOUBLE_IMPL(data),"

Status: RESOLVED DUPLICATE of bug 618129

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: more information

function a() {
  f = Function("\
    this.watch(\"w\",\
      function(){\
        d={};\
        Object.defineProperty(this,\"w\",({get:/x/}))\
      }\
    );\
    w=b;\
    []()\
  ")
  f()
}
function b() {}
a()

crashes js opt shell at JSObject::allocSlot on TM changeset de9053031560 without -m nor -j when passed in as a CLI argument, and asserts debug shell at Assertion failure: JSVAL_IS_DOUBLE_IMPL(data)

s-s because this seems to involve a scary address, setting sg:critical?

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   54300:7ef107ab081e
user:        Brendan Eich
date:        Thu Sep 16 11:56:54 2010 -0700
summary:     Fix shape vs. slot management under putProperty, plus related layering and error reporting fixes (596805, r=jorendorff).