692300 - Assertion failure: srcArgs.callee().getFunctionPrivate()->native() == native, at jswrapper.cpp:740

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 38a487da2def (no options required):


var x = newGlobal("new-compartment").Date;
var OBJ = new MyObject( new x(0) );
eval("OBJ.valueOf()");
function MyObject( value ) {
  this.valueOf = x.prototype.valueOf;
}


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   78133:6029755897c3
user:        Luke Wagner
date:        Tue Oct 04 10:48:36 2011 -0700
summary:     Bug 690825 - Fix nativeCall assert; HandleNonGenericMethodClassMismatch should not assume args.callee() is the native (r=waldo)

Comment 1

[Luke Wagner [:luke]]

Oops, harmless assert in this case; easy fix.

Comment 2

[Luke Wagner [:luke]]

Attachment: fix Date.prototype.valueOf, add test

And of course, I somehow forgot the 44th Date.prototype non-generic method in testCrossCompartmentTransparency.

Comment 3

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e7968e208ea8

Comment 4

[Marco Bonardo [:mak] (Away 10-21 August)]

https://hg.mozilla.org/mozilla-central/rev/e7968e208ea8

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929