1198634 - Wrong argument index for DecompileArg

Status: NEW

(Core :: JavaScript: Standard Library, defect)

Description

[André Bargull [:anba]]

Test case:
---
Number.prototype.from = Int8Array.from;
0..from([], 1)
---

Expected: Throws TypeError with message "0 is not a constructor"
Actual: Throws TypeError with message "1 is not a constructor"

http://hg.mozilla.org/mozilla-central/file/f61c3cc0eb8b/js/src/builtin/TypedArray.js#l1009

>  ThrowTypeError(JSMSG_NOT_CONSTRUCTOR, DecompileArg(1, C));





There is also:

http://hg.mozilla.org/mozilla-central/file/f61c3cc0eb8b/js/src/builtin/TypedObject.js#l947

> ThrowTypeError(JSMSG_NOT_FUNCTION, DecompileArg(0, maybeFunc));

This could be changed to "DecompileArg(2, maybeFunc)", or probably just "assert(IsCallable(maybeFunc))", because both callers to MapUntypedSeqImpl already check IsCallable.

Comment 1

[aliyua7]

Hello, I would like to work on this bug