Closed Bug 1055307 Opened 8 years ago Closed 7 years ago

ArrayIteratorNext incorrectly stringifies |this| in case of error

Categories

(Core :: JavaScript: Standard Library, defect)

defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: Waldo, Unassigned)

References

(Blocks 1 open bug)

Details

ArrayIteratorNext begins like so:

function ArrayIteratorNext() {
    // FIXME: ArrayIterator prototype should not pass this test.  Bug 924059.
    if (!IsObject(this) || !IsArrayIterator(this))
        ThrowError(JSMSG_INCOMPATIBLE_METHOD, "ArrayIterator", "next", ToString(this));

which implies that

[jwalden@find-waldo-now src]$ dbg/js/src/js
js> var next = [1, 2, 3, 4, 5]['@@iterator']().next     
js> next.call({ toString: function() { throw 42; } }) 
uncaught exception: 42

which is wrong.

This is sort of another variety of bug 633623, except that seeing ToString instead of, say, DecompileArg makes it far more obvious.  (That, and I think DecompileArg sometimes may not actually invoke user-defined code, but when it does/doesn't isn't clear from a super-quick skim.)

At the least it seems to me this should change to DecompileArg, which has the slight virtue of not invoking a method (toString) that the user is somewhat likely to have defined.  The full fix probably wants to wait for bug 633623.
No longer reproducible - Resolving as WFM.

js> var next = [1, 2, 3, 4, 5][Symbol.iterator]().next 
js> next.call({ toString: function() { throw 42; } })
typein:2:1 TypeError: CallArrayIteratorMethodIfWrapped method called on incompatible Object
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.