From 8167bb1a7cf022ef780a4381c214eed191c45476 Mon Sep 17 00:00:00 2001
From: Jason Orendorff <jorendorff@mozilla.com>
Date: Mon, 1 Mar 2010 11:07:40 -0600
Subject: [PATCH] Bug 548276 - "Assertion failure: HAS_FUNCTION_CLASS(funobj),
 at ../jsdbgapi.cpp". r=jwalden.

---
 js/src/jsdbgapi.cpp                            | 4 +++-
 js/src/tests/js1_8_5/regress/regress-548276.js | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 js/src/tests/js1_8_5/regress/regress-548276.js

diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index 644127b34815..7803f7aaf731 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -773,8 +773,10 @@ IsWatchedProperty(JSContext *cx, JSScopeProperty *sprop)
 {
     if (sprop->attrs & JSPROP_SETTER) {
         JSObject *funobj = sprop->setterObject();
-        JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
+        if (!funobj->isFunction())
+            return false;
 
+        JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
         return FUN_NATIVE(fun) == js_watch_set_wrapper;
     }
     return sprop->setterOp() == js_watch_set;
diff --git a/js/src/tests/js1_8_5/regress/regress-548276.js b/js/src/tests/js1_8_5/regress/regress-548276.js
new file mode 100644
index 000000000000..98192e2222a8
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-548276.js
@@ -0,0 +1,9 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Gary Kwong and Jason Orendorff
+ */
+var obj = {};
+obj.__defineSetter__("x", function() {});
+obj.watch("x", function() {});
+obj.__defineSetter__("x", /a/);