Assertion 'is_current_accessor_descriptor' failed in ecma_op_general_object_define_own_property

[renatahodovan]

Jerry version:

Checked revision: 77df022
Build: debug.linux

OS:

Ubuntu 14.04, x86_64

Test case:

v_0 = [,];
v_1 = [,];
v_2 = Object.defineProperties([,], { '0': {  get: function() { } } });
function f_0() {}

Backtrace:

ICE: Assertion 'is_current_accessor_descriptor' failed at jerryscript/jerry-core/ecma/operations/ecma-objects-general.cpp(ecma_op_general_object_define_own_property):835.
Error: ERR_FAILED_INTERNAL_ASSERTION
[Inferior 1 (process 26880) exited with code 0170]
(gdb) bt
#0  ecma_op_general_object_define_own_property (obj_p=0x7ebcf0 <_ZL13mem_heap_area.4015+1456>, 
    property_name_p=0x7ebde0 <_ZL13mem_heap_area.4015+1696>, property_desc_p=0x7fffffffd010, is_throw=false)
    at jerryscript/jerry-core/ecma/operations/ecma-objects-general.cpp:835
#1  0x000000000047567e in ecma_op_array_object_define_own_property (obj_p=0x7ebcf0 <_ZL13mem_heap_area.4015+1456>, 
    property_name_p=0x7ebde0 <_ZL13mem_heap_area.4015+1696>, property_desc_p=0x7fffffffd010, is_throw=true)
    at jerryscript/jerry-core/ecma/operations/ecma-array-object.cpp:430
#2  0x000000000047cf73 in ecma_op_object_define_own_property (obj_p=0x7ebcf0 <_ZL13mem_heap_area.4015+1456>, 
    property_name_p=0x7ebde0 <_ZL13mem_heap_area.4015+1696>, property_desc_p=0x7fffffffd010, is_throw=true)
    at jerryscript/jerry-core/ecma/operations/ecma-objects.cpp:451
#3  0x0000000000496efe in ecma_builtin_object_object_define_properties(unsigned int, unsigned int, unsigned int) [clone .19528] (this_arg=687, 
    arg1=731, arg2=763) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object.cpp:378
#4  0x00000000004a23e9 in ecma_builtin_object_dispatch_routine (builtin_routine_id=51, this_arg_value=687, 
    arguments_list=0x82b6d0 <_ZL13mem_heap_area.4015+262032>, arguments_number=2)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object.inc.h:72
#5  0x00000000004aafd5 in ecma_builtin_dispatch_routine (builtin_object_id=ECMA_BUILTIN_ID_OBJECT, builtin_routine_id=51, this_arg_value=687, 
    arguments_list=0x82b6d0 <_ZL13mem_heap_area.4015+262032>, arguments_number=2)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.inc.h:29
#6  0x00000000004aa7a3 in ecma_builtin_dispatch_call (obj_p=0x7ebcc8 <_ZL13mem_heap_area.4015+1416>, this_arg_value=687, 
    arguments_list_p=0x82b6d0 <_ZL13mem_heap_area.4015+262032>, arguments_list_len=2)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.cpp:398
#7  0x00000000004697e4 in ecma_op_function_call (func_obj_p=0x7ebcc8 <_ZL13mem_heap_area.4015+1416>, this_arg_value=687, 
    arguments_list_p=0x82b6d0 <_ZL13mem_heap_area.4015+262032>, arguments_list_len=2)
    at jerryscript/jerry-core/ecma/operations/ecma-function-object.cpp:684
#8  0x0000000000458c63 in opfunc_call_n (opdata=..., int_data=0x7fffffffd560) at jerryscript/jerry-core/vm/opcodes.cpp:710
#9  0x00000000004c1a11 in vm_loop (int_data=0x7fffffffd560) at jerryscript/jerry-core/vm/vm.cpp:452
#10 0x00000000004b86e5 in vm_run_from_pos (start_pos=1, this_binding_value=15, lex_env_p=0x7eb770 <_ZL13mem_heap_area.4015+48>, is_strict=false, 
    is_eval_code=false) at jerryscript/jerry-core/vm/vm.cpp:528
#11 0x00000000004c17df in vm_run_global () at jerryscript/jerry-core/vm/vm.cpp:383
#12 0x00000000004bf487 in jerry_run () at jerryscript/jerry-core/jerry.cpp:1243
#13 0x00000000004bdab6 in main (argc=2, argv=0x7fffffffd908) at jerryscript/main-linux.cpp:248

Additional comment:

This issue might be similar or related to #115 since omitting any lines - except the third one - results in that assertion failure.

[galpeter]

Here's what I know about the problem: In the line ~835 of the ecma-objects-general.cpp file there is a code like this:

   ...
   if (property_desc_p->is_get_defined)
   {
     JERRY_ASSERT (is_current_accessor_descriptor);
     ecma_set_named_accessor_property_getter (obj_p, current_p, property_desc_p->get_p);
   }
   ...

There problem is with the argument of the assert, because by this point the type of the current descriptor could have changed (~line 752 and ecma 262 8.12.9 step 9. b-c) and the is_current_accessor_descriptor is not updated after that point and still has the old value.

Also a more simpler testcase:

var a = { x:2 };
Object.defineProperty(a, "x", {
      enumerable: true,
      configurable: true,
      get: function() { return 0; }
 });

and it asserts in the same manner if the code is something like this:

var a = {}
Object.defineProperty(a, "x", {
      enumerable: true,
      configurable: true,
      get: function() { return 0; }
 });

Object.defineProperty(a, "x", {
      enumerable: true,
      configurable: true,
      value: -2
 });

[galpeter]

@renatahodovan, could you verify that the current master now does not assert on the test case mentioned in this issue? (I think it's ok now, but just to be sure)

[renatahodovan]

@galpeter, yeah it works fine for me too now.

[galpeter]

Thanks, then closing issue as fixed