Last Comment Bug 692300 - Assertion failure: srcArgs.callee().getFunctionPrivate()->native() == native, at jswrapper.cpp:740
: Assertion failure: srcArgs.callee().getFunctionPrivate()->native() == native,...
Status: RESOLVED FIXED
js-triage-done
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla10
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-10-05 15:35 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:35 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix Date.prototype.valueOf, add test (3.32 KB, patch)
2011-10-05 16:05 PDT, Luke Wagner [:luke]
jwalden+bmo: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-10-05 15:35:12 PDT
The following test asserts on mozilla-central revision 38a487da2def (no options required):


var x = newGlobal("new-compartment").Date;
var OBJ = new MyObject( new x(0) );
eval("OBJ.valueOf()");
function MyObject( value ) {
  this.valueOf = x.prototype.valueOf;
}


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   78133:6029755897c3
user:        Luke Wagner
date:        Tue Oct 04 10:48:36 2011 -0700
summary:     Bug 690825 - Fix nativeCall assert; HandleNonGenericMethodClassMismatch should not assume args.callee() is the native (r=waldo)
Comment 1 Luke Wagner [:luke] 2011-10-05 15:52:26 PDT
Oops, harmless assert in this case; easy fix.
Comment 2 Luke Wagner [:luke] 2011-10-05 16:05:32 PDT
Created attachment 565053 [details] [diff] [review]
fix Date.prototype.valueOf, add test

And of course, I somehow forgot the 44th Date.prototype non-generic method in testCrossCompartmentTransparency.
Comment 4 Marco Bonardo [::mak] (Away 6-20 Aug) 2011-10-11 02:29:50 PDT
https://hg.mozilla.org/mozilla-central/rev/e7968e208ea8
Comment 5 Christian Holler (:decoder) 2013-01-19 14:35:01 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.