Bug 548276 - "Assertion failure: HAS_FUNCTION_CLASS(funobj), at ../jsdbgapi.cpp". r=jwalden.

js/src/jsdbgapi.cpp

@@ -773,8 +773,10 @@ IsWatchedProperty(JSContext *cx, JSScopeProperty *sprop)
 {
     if (sprop->attrs & JSPROP_SETTER) {
         JSObject *funobj = sprop->setterObject();
-        JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
+        if (!funobj->isFunction())
+            return false;
 
+        JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
         return FUN_NATIVE(fun) == js_watch_set_wrapper;
     }
     return sprop->setterOp() == js_watch_set;

js/src/tests/js1_8_5/regress/regress-548276.js

@@ -0,0 +1,9 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Gary Kwong and Jason Orendorff
+ */
+var obj = {};
+obj.__defineSetter__("x", function() {});
+obj.watch("x", function() {});
+obj.__defineSetter__("x", /a/);