Closed Bug 692300 Opened 9 years ago Closed 9 years ago

Assertion failure: srcArgs.callee().getFunctionPrivate()->native() == native, at jswrapper.cpp:740

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla10

People

(Reporter: decoder, Assigned: luke)

Details

(Keywords: assertion, testcase, Whiteboard: js-triage-done)

Attachments

(1 file)

The following test asserts on mozilla-central revision 38a487da2def (no options required):


var x = newGlobal("new-compartment").Date;
var OBJ = new MyObject( new x(0) );
eval("OBJ.valueOf()");
function MyObject( value ) {
  this.valueOf = x.prototype.valueOf;
}


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   78133:6029755897c3
user:        Luke Wagner
date:        Tue Oct 04 10:48:36 2011 -0700
summary:     Bug 690825 - Fix nativeCall assert; HandleNonGenericMethodClassMismatch should not assume args.callee() is the native (r=waldo)
Oops, harmless assert in this case; easy fix.
Whiteboard: js-triage-needed → js-triage-done
And of course, I somehow forgot the 44th Date.prototype non-generic method in testCrossCompartmentTransparency.
Assignee: general → luke
Attachment #565053 - Flags: review?(jwalden+bmo)
Attachment #565053 - Flags: review?(jwalden+bmo) → review+
https://hg.mozilla.org/mozilla-central/rev/e7968e208ea8
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.