743101 - Assertion failure: srcArgs.callee().toFunction()->native() == native || srcArgs.callee().toFunction()->native() == js_generic_native_method_dispatcher, at jswrapper.cpp:788

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision da0d07b5ca1e (options -m -n -a):


var assertThrowsInstanceOf = function assertThrowsInstanceOf(f, ctor, msg) {
    f();
}
function testcase(obj, fn) {
    var args = Array.slice(arguments, 2);
    assertThrowsInstanceOf(function () { fn.apply(obj, args); }, TypeError);
}
function test(obj) {
    testcase(obj, Map.prototype.size);
}
test((newGlobal('new-compartment')));

Comment 1

[Jesse Ruderman]

The first bad revision is:
changeset:   3f51e7052b7d
user:        Jason Orendorff
date:        Thu Mar 01 09:01:45 2012 -0600
summary:     Add Map.prototype.size and Set.prototype.size. Bug 726298, r=luke.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

Assigning to djvj for no good reason. :)

Comment 3

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fcd6861385da

Comment 4

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/fcd6861385da

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/collections/bug-743101.js.