Bug 567152 - Assertion failure: !generic(). r=brendan.

--HG--
extra : rebase_source : 8a09f3c6b9570d764ebc404a2ff870625e156801

js/src/jsobjinlines.h

@@ -493,7 +493,7 @@ JSObject::unbrand(JSContext *cx)
                 return false;
             }
         }
-        scope->setGeneric();
+        scope->unbrand(cx);
         JS_UNLOCK_SCOPE(cx, scope);
     }
     return true;

js/src/jsscope.h

@@ -224,7 +224,9 @@ struct JSScope : public JSObjectMap
 #endif
     JSObject        *object;            /* object that owns this scope */
     uint32          freeslot;           /* index of next free slot in object */
+  protected:
     uint8           flags;              /* flags, see below */
+  public:
     int8            hashShift;          /* multiplicative hash shift */
 
     uint16          spare;              /* reserved */
@@ -423,9 +425,10 @@ struct JSScope : public JSObjectMap
      * properties without magic getters and setters), and its scope->shape
      * evolves whenever a function value changes.
      */
-    bool branded()              { JS_ASSERT(!generic()); return flags & BRANDED; }
+    bool branded()              { return flags & BRANDED; }
 
     bool brand(JSContext *cx, uint32 slot, jsval v) {
+        JS_ASSERT(!generic());
         JS_ASSERT(!branded());
         generateOwnShape(cx);
         if (js_IsPropertyCacheDisabled(cx))  // check for rt->shapeGen overflow
@@ -435,7 +438,17 @@ struct JSScope : public JSObjectMap
     }
 
     bool generic()              { return flags & GENERIC; }
-    void setGeneric()           { flags |= GENERIC; }
+
+    /*
+     * Here and elsewhere "unbrand" means "make generic". We never actually
+     * clear the BRANDED bit on any object. Once branded, there's no point in
+     * being generic, since the shape has already evolved unpredictably. So
+     * obj->unbrand() on a branded object does nothing.
+     */
+    void unbrand(JSContext *cx) {
+        if (!branded())
+            flags |= GENERIC;
+    }
 
     bool hadIndexedProperties() { return flags & INDEXED_PROPERTIES; }
     void setIndexedProperties() { flags |= INDEXED_PROPERTIES; }

js/src/tests/js1_8_5/regress/jstests.list

@@ -21,4 +21,5 @@ script regress-563210.js
 script regress-563221.js
 script regress-566549.js
 script regress-566914.js
+script regress-567152.js
 script regress-569306.js

js/src/tests/js1_8_5/regress/regress-567152.js

@@ -0,0 +1,12 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+// Contributors: Gary Kwong <gary@rumblingedge.com>,
+//               Jason Orendorff <jorendorff@mozilla.com>
+
+function c(a) {
+    this.f = function () { a; };
+}
+c(0);  // set both BRANDED and GENERIC bits in global scope
+Object.defineProperty(this, "f", {configurable: true, enumerable: true, value: 3});
+
+reportCompare(0, 0, "");