[Webkit-unassigned] [Bug 17936] "ASSERTION FAILED: false" (GetterSetterImp::toObject is called)

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=17936





------- Comment #2 from mrowe at apple.com  2008-03-19 14:48 PDT -------
JSObject::defineSetter calls putDirect(propertyName, gs, GetterSetter), where
"GetterSetter" is an attribute.  If a property exists with the name, this ends
up inside PropertyMap::put at the following code:

            // Put a new value in an existing hash table entry.
            m_u.table->entries()[entryIndex - 1].value = value;
            // Attributes are intentionally not updated.

The problem here is the fact that we do not update the attribute of the
property, which will lead to the PropertyMap returning an incorrect value for
containsGettersOrSetters() when it is called after the setter for "a" in the
test case is deleted.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.