The following testcase asserts on TM revision e77af15dc4d4 (run with options -j -m): order = Number.POSITIVE_INFINITY; var i = 0; for (let methods = 0; methods < 4; ++methods) { obj = {m: function () { return ".getSeconds()".x; }}; obj.watch("m", function (id, oldval, newval) { methods[i] = oldval; }); obj.m = 0; }

Not sure if this is related to an older bug 561359..

For this slightly different test case: order = Number.POSITIVE_INFINITY; var i = 0; for (let methods = 0; methods < 4; ++methods) { obj = {m: function () { return ".getSeconds()".x; }}; obj.watch("m", function (id, oldval, newval) { methods[i] = 0 }); dumpObject(obj); obj.m = 0; } I get this output: object 00B0D040 class 01331540 Object flags: method_barrier own_shape proto <Object at 00B02060> parent <global object at 00B02010> properties: ((Shape *) 00B09D58) enumerate method=00B0A0B0 getterOp=00B0A0B0 setterOp=js_watch_set "m": slot 0 = <unnamed function (c:/sources/scratch/de.js:4) at 00B0A0B0 (JSFunction at 00B0A0B0)> object 00B0D088 class 01331540 Object flags: method_barrier own_shape proto <Object at 00B02060> parent <global object at 00B02010> properties: ((Shape *) 00B09D58) enumerate method=00B0A0B0 getterOp=00B0A0B0 setterOp=js_watch_set "m": slot 0 = <unnamed function (c:/sources/scratch/de.js:4) at 00B0C1C8 (JSFunction at 00B0A0B0)> Assertion failure: pobj->getSlot(shape->slot).toObject() == shape->methodObject(), at c:/sources/tracemonkey/js/src/jsobj.cpp:5592 On the second iteration of the loop, |obj| gets what appears to be a new clone of the same function in its slot. If I move the |dumpObject| up one line, there is no assert. Must be some twitchy interaction with the read barrier.

Decoder: With your testcase in the original post I get Assertion failure: shape.methodObject() == prev.toObject(), at /home/alex/src/js/src/jsscope.cpp:1195 Stack trace next...

Taking.

I think this is a duplicate of 561359. It apparently has nothing to do with watchpoints. This test is equivalent except for the watch() call, and it asserts the same way: order = Number.POSITIVE_INFINITY; var i = 0; for (let methods = 0; methods < 4; ++methods) { obj = {m: function () { return ".getSeconds()".x; }}; f = function (id, oldval, newval) { methods[i] = oldval; }; obj.m = 0; }

Confirmed. This is fixed.

A testcase for this bug was already added in the original bug (bug 561359).