Bug 677593 - [jsdbg2] Assertion failure: (ptrBits & 0x7) == 0, at ../jsval.h:705. r=jimb.
authorJason Orendorff <jorendorff@mozilla.com>
Tue, 09 Aug 2011 15:46:41 -0500
changeset 75235 cb0579abe3535dc7f66f536802fef7bbf9151b35
parent 75234 f189dd6316ebcf2aa3dd6ef82e1489282f019309
child 75236 7333f40750638585d73db564444aa900bb3811ae
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersjimb
bugs677593
milestone8.0a1
Bug 677593 - [jsdbg2] Assertion failure: (ptrBits & 0x7) == 0, at ../jsval.h:705. r=jimb.
js/src/jit-test/tests/debug/Object-defineProperty-surfaces-01.js
js/src/vm/Debugger.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Object-defineProperty-surfaces-01.js
@@ -0,0 +1,8 @@
+// Debugger.Object.prototype.defineProperty with too few arguments throws.
+
+load(libdir + "asserts.js");
+
+var g = newGlobal('new-compartment');
+var dbg = new Debugger;
+var gw = dbg.addDebuggee(g);
+assertThrowsInstanceOf(function () { gw.defineProperty("x"); }, TypeError);
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -3078,22 +3078,23 @@ WrapIdAndPropDesc(JSContext *cx, JSObjec
            comp->wrap(cx, &desc->set) &&
            (!obj->isProxy() || desc->makeObject(cx));
 }
 
 static JSBool
 DebuggerObject_defineProperty(JSContext *cx, uintN argc, Value *vp)
 {
     THIS_DEBUGOBJECT_OWNER_REFERENT(cx, vp, "defineProperty", dbg, obj);
+    REQUIRE_ARGC("Debugger.Object.defineProperty", 2);
 
     jsid id;
-    if (!ValueToId(cx, argc >= 1 ? vp[2] : UndefinedValue(), &id))
+    if (!ValueToId(cx, vp[2], &id))
         return JS_FALSE;
 
-    const Value &descval = argc >= 1 ? vp[3] : UndefinedValue();
+    const Value &descval = vp[3];
     AutoPropDescArrayRooter descs(cx);
     PropDesc *desc = descs.append();
     if (!desc || !desc->initialize(cx, descval, false))
         return false;
 
     desc->pd.setUndefined();
     if (!UnwrapPropDesc(cx, dbg, obj, desc))
         return false;