From f0c623c2f5a76f2ff21ffe06949608fc938f1b8d Mon Sep 17 00:00:00 2001 From: Jason Orendorff Date: Fri, 6 Apr 2012 16:58:43 -0500 Subject: [PATCH] Fix "Assertion failure: srcArgs.callee().toFunction()->native() == native || srcArgs.callee().toFunction()->native() == js_generic_native_method_dispatcher, at jswrapper.cpp:788." Bug 743101, r=djvj. --- js/src/builtin/MapObject.cpp | 4 ++-- js/src/jit-test/tests/collections/bug-743101.js | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 js/src/jit-test/tests/collections/bug-743101.js diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp index 3e864ed5404a..d9bd66b85f17 100644 --- a/js/src/builtin/MapObject.cpp +++ b/js/src/builtin/MapObject.cpp @@ -286,7 +286,7 @@ MapObject::construct(JSContext *cx, unsigned argc, Value *vp) JSBool MapObject::size(JSContext *cx, unsigned argc, Value *vp) { - THIS_MAP(get, cx, argc, vp, args, map); + THIS_MAP(size, cx, argc, vp, args, map); JS_STATIC_ASSERT(sizeof map.count() <= sizeof(uint32_t)); args.rval().setNumber(map.count()); return true; @@ -455,7 +455,7 @@ SetObject::construct(JSContext *cx, unsigned argc, Value *vp) JSBool SetObject::size(JSContext *cx, unsigned argc, Value *vp) { - THIS_SET(has, cx, argc, vp, args, set); + THIS_SET(size, cx, argc, vp, args, set); JS_STATIC_ASSERT(sizeof set.count() <= sizeof(uint32_t)); args.rval().setNumber(set.count()); return true; diff --git a/js/src/jit-test/tests/collections/bug-743101.js b/js/src/jit-test/tests/collections/bug-743101.js new file mode 100644 index 000000000000..d30f3fc4e03c --- /dev/null +++ b/js/src/jit-test/tests/collections/bug-743101.js @@ -0,0 +1,5 @@ +load(libdir + "asserts.js"); + +var g = newGlobal('new-compartment'); +assertThrowsInstanceOf(function () { Map.prototype.size.apply(g, []); }, g.TypeError); +assertThrowsInstanceOf(function () { Set.prototype.size.apply(g, []); }, g.TypeError);