Fix "Assertion failure: srcArgs.callee().toFunction()->native() == native || srcArgs.callee().toFunction()->native() == js_generic_native_method_dispatcher, at jswrapper.cpp:788." Bug 743101, r=djvj.
authorJason Orendorff <jorendorff@mozilla.com>
Fri, 06 Apr 2012 16:58:43 -0500
changeset 94515 fcd6861385da970ea2cdd7c2d4700b57571e57ba
parent 94514 63cd904be4a7e2d1c103ed8826f9a65ae480c50b
child 94516 a6527fdc59f4a7f40a54c943389a4ac46d5f4ec2
push id886
push userlsblakk@mozilla.com
push dateMon, 04 Jun 2012 19:57:52 +0000
treeherdermozilla-beta@bbd8d5efd6d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdjvj
bugs743101
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Fix "Assertion failure: srcArgs.callee().toFunction()->native() == native || srcArgs.callee().toFunction()->native() == js_generic_native_method_dispatcher, at jswrapper.cpp:788." Bug 743101, r=djvj.
js/src/builtin/MapObject.cpp
js/src/jit-test/tests/collections/bug-743101.js
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -281,17 +281,17 @@ MapObject::construct(JSContext *cx, unsi
 #define ARG0_KEY(cx, args, key)                                               \
     HashableValue key;                                                        \
     if (args.length() > 0 && !key.setValue(cx, args[0]))                      \
         return false
 
 JSBool
 MapObject::size(JSContext *cx, unsigned argc, Value *vp)
 {
-    THIS_MAP(get, cx, argc, vp, args, map);
+    THIS_MAP(size, cx, argc, vp, args, map);
     JS_STATIC_ASSERT(sizeof map.count() <= sizeof(uint32_t));
     args.rval().setNumber(map.count());
     return true;
 }
 
 JSBool
 MapObject::get(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -450,17 +450,17 @@ SetObject::construct(JSContext *cx, unsi
 }
 
 #define THIS_SET(native, cx, argc, vp, args, set)                             \
     UNPACK_THIS(SetObject, native, cx, argc, vp, args, set)
 
 JSBool
 SetObject::size(JSContext *cx, unsigned argc, Value *vp)
 {
-    THIS_SET(has, cx, argc, vp, args, set);
+    THIS_SET(size, cx, argc, vp, args, set);
     JS_STATIC_ASSERT(sizeof set.count() <= sizeof(uint32_t));
     args.rval().setNumber(set.count());
     return true;
 }
 
 JSBool
 SetObject::has(JSContext *cx, unsigned argc, Value *vp)
 {
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/collections/bug-743101.js
@@ -0,0 +1,5 @@
+load(libdir + "asserts.js");
+
+var g = newGlobal('new-compartment');
+assertThrowsInstanceOf(function () { Map.prototype.size.apply(g, []); }, g.TypeError);
+assertThrowsInstanceOf(function () { Set.prototype.size.apply(g, []); }, g.TypeError);