js> this.__defineSetter__("x", function() {}); x %= 5; Assertion failure: !SPROP_HAS_STUB_GETTER(sprop), at jsobj.c:3427

The JSMSG_GETTER_ONLY error makes for a big difference between js_NativeGet and js_NativeSet: the former must handle the stub case before calling SPROP_GET (which now requires a non-stub [null] getter), whether or not there's a slot allocated. OTOH, js_NativeSet knows that if there's no slot and no setter, SPROP_SET will throw before it might dereference a null (stub) setter. /be

Fixed on trunk (with slightly improved comment): js/src/jsobj.c rev 3.319 /be

This was another regression from bug 365851. /be

Comment on attachment 250927 [details] [diff] [review] fix Yikes, this is needed on the branches, stat! /be

Comment on attachment 250927 [details] [diff] [review] fix Approved for both branches, a=jay for drivers.

Fixed on 1.8 and 1.8 branches: js/src/jsobj.c rev 3.208.2.47 js/src/jsscope.h rev 3.38.4.2 js/src/jsobj.c rev 3.208.2.12.2.21 js/src/jsscope.h rev 3.38.12.1 /be

/cvsroot/mozilla/js/tests/js1_5/GetSet/regress-366396.js,v <-- regress-366396.js initial revision: 1.1

verified fixed 1.8.0, 1.8.1, 1.9.0 2007-01-23 win/mac*/linux