657586 - TI: Crash [@ js::types::TypeFailure] involving missing type in object #3:26:Object set: #2

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    with([]) {}
    Object.defineProperty([], "", {
        set: (function() {})
    })
})()

crashes js debug shell on JM changeset 8aa5d9272628 with -m and -n at js::types::TypeFailure

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   69785:f18e992f6ec8
user:        Brian Hackett
date:        Mon May 16 16:15:37 2011 -0700
summary:     [INFER] Move addTypeProperty barriers under obj->setProperty, obj->defineProperty, bug 619693.

Comment 1

[Brian Hackett [Laid off!]]

When defining native properties we weren't updating the type information for properties with a method barrier.  Weird this didn't show up in jit-tests or jstests, but it looks like it did on tinderbox.

http://hg.mozilla.org/projects/jaegermonkey/rev/97f9e3274bd5

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929