Fix bogus assert when using SETMETHOD on a property with a setter, bug 559912. r=brendan
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 13 Dec 2010 16:36:35 -0800
changeset 59236 421dafd0878e5ed3d5a92ac1d565261cd458be2b
parent 59235 e5090c9f6be394214f2efbfa87496084c391a51d
child 59237 0343557b0c7ac5580b9fdaea0d02f0c60faf3f33
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersbrendan
bugs559912
milestone2.0b8pre
Fix bogus assert when using SETMETHOD on a property with a setter, bug 559912. r=brendan
js/src/jit-test/tests/basic/bug559912.js
js/src/jsobj.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug559912.js
@@ -0,0 +1,12 @@
+
+function s(f) { this._m = f; }
+function C() {
+    Object.defineProperty(this, "m", {set: s});
+    this.m = function () {};
+}
+var last = {};
+for (var i = 0; i < 20; i++) {
+  var a = new C;
+  assertEq(a._m === last._m, false);
+  last = a;
+}
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5510,17 +5510,16 @@ js_SetPropertyHelper(JSContext *cx, JSOb
              * cases.
              */
             bool identical = shape->isMethod() && &shape->methodObject() == &vp->toObject();
             if (!identical) {
                 if (!obj->methodShapeChange(cx, *shape))
                     return false;
 
                 JS_ASSERT(IsFunctionObject(*vp));
-                JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
 
                 JSObject *funobj = &vp->toObject();
                 JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
                 if (fun == funobj) {
                     funobj = CloneFunctionObject(cx, fun, fun->parent);
                     if (!funobj)
                         return JS_FALSE;
                     vp->setObject(*funobj);