Last Comment Bug 743101 - Assertion failure: srcArgs.callee().toFunction()->native() == native || srcArgs.callee().toFunction()->native() == js_generic_native_method_dispatcher, at jswrapper.cpp:788
: Assertion failure: srcArgs.callee().toFunction()->native() == native || srcAr...
Status: RESOLVED FIXED
js-triage-needed [jsbugmon:update]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla14
Assigned To: Jason Orendorff [:jorendorff]
:
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2012-04-05 17:38 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:32 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v1 (1.81 KB, patch)
2012-04-06 09:55 PDT, Jason Orendorff [:jorendorff]
kvijayan: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-04-05 17:38:15 PDT
The following test asserts on mozilla-central revision da0d07b5ca1e (options -m -n -a):


var assertThrowsInstanceOf = function assertThrowsInstanceOf(f, ctor, msg) {
    f();
}
function testcase(obj, fn) {
    var args = Array.slice(arguments, 2);
    assertThrowsInstanceOf(function () { fn.apply(obj, args); }, TypeError);
}
function test(obj) {
    testcase(obj, Map.prototype.size);
}
test((newGlobal('new-compartment')));
Comment 1 Jesse Ruderman 2012-04-05 17:59:19 PDT
The first bad revision is:
changeset:   3f51e7052b7d
user:        Jason Orendorff
date:        Thu Mar 01 09:01:45 2012 -0600
summary:     Add Map.prototype.size and Set.prototype.size. Bug 726298, r=luke.
Comment 2 Jason Orendorff [:jorendorff] 2012-04-06 09:55:40 PDT
Created attachment 612913 [details] [diff] [review]
v1

Assigning to djvj for no good reason. :)
Comment 3 Jason Orendorff [:jorendorff] 2012-04-06 15:29:42 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/fcd6861385da
Comment 4 Matt Brubeck (:mbrubeck) 2012-04-09 10:11:58 PDT
https://hg.mozilla.org/mozilla-central/rev/fcd6861385da
Comment 5 Christian Holler (:decoder) 2013-01-14 08:32:27 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/collections/bug-743101.js.

Note You need to log in before you can comment on or make changes to this bug.