Bug 585257 - "Assertion failure: obj == obj2". r=gal.

js/src/jsapi.cpp

@@ -3518,12 +3518,10 @@ GetPropertyDescriptorById(JSContext *cx, JSObject *obj, jsid id, uintN flags,
         }
         JS_UNLOCK_OBJ(cx, obj2);
     } else if (obj2->isProxy()) {
-        JS_ASSERT(obj == obj2);
-
         JSAutoResolveFlags rf(cx, flags);
         return own
-            ? JSProxy::getOwnPropertyDescriptor(cx, obj, id, desc)
-            : JSProxy::getPropertyDescriptor(cx, obj, id, desc);
+            ? JSProxy::getOwnPropertyDescriptor(cx, obj2, id, desc)
+            : JSProxy::getPropertyDescriptor(cx, obj2, id, desc);
     } else {
         if (!obj2->getAttributes(cx, id, &desc->attrs))
             return false;

js/src/tests/js1_8_5/regress/regress-585257.js

@@ -0,0 +1,6 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+// Contributor: Gary Kwong <gary@rumblingedge.com>
+
+Object.create(evalcx('')).__defineSetter__('toString', function(){});
+reportCompare(0, 0, "ok");