Closed
Bug 548276
Opened 15 years ago
Closed 15 years ago
"Assertion failure: HAS_FUNCTION_CLASS(funobj), at ../jsdbgapi.cpp"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: gkw, Assigned: jorendorff)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file, 1 obsolete file)
(deleted),
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
__defineSetter__("x", function() {});
(function() {
this.watch("x", function() {})
})();
__defineSetter__("x", /a/)
asserts js debug shell on TM tip without -j at Assertion failure: HAS_FUNCTION_CLASS(funobj), at ../jsdbgapi.cpp:776
To reproduce this, pass the testcase as a CLI argument. (e.g. ./js -j testcase.js)
autoBisect shows this is probably related to bug 547314:
The first bad revision is:
changeset: 38505:65eeef03da7c
user: Andreas Gal
date: Mon Feb 22 16:30:22 2010 -0800
summary: Introduce ObjectOps for typeOf and make trace a mandatory ObjectOp (547314, r=brendan).
Assignee | ||
Updated•15 years ago
|
Assignee: general → jorendorff
Comment 1•15 years ago
|
||
I looked into this yesterday and forgot to update the bug. We allow callable objects as setters/getters, so the code should just return false if !HAS_FUNCTION_CLASS() instead of asserting.
Comment 2•15 years ago
|
||
Assignee | ||
Comment 3•15 years ago
|
||
Yay for assertions.
Attachment #428943 -
Flags: review?(jwalden+bmo)
Comment 4•15 years ago
|
||
Comment on attachment 428943 [details] [diff] [review]
v1
*stamp*
Attachment #428943 -
Flags: review?(jwalden+bmo) → review+
Reporter | ||
Comment 5•15 years ago
|
||
Comment on attachment 428940 [details] [diff] [review]
patch
jorendorff's patch is the same as this - with a test. Marking obsolete to clear up future "discover patches with no review flags set" endeavours.
Attachment #428940 -
Attachment is obsolete: true
Comment 6•15 years ago
|
||
Thanks Gary.
Reporter | ||
Comment 7•15 years ago
|
||
Whiteboard: fixed-in-tracemonkey
Comment 8•15 years ago
|
||
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Comment 9•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-548276.js.
Flags: in-testsuite+
Reporter | ||
Comment 10•12 years ago
|
||
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•