1055307 - ArrayIteratorNext incorrectly stringifies |this| in case of error

Status: RESOLVED WORKSFORME

(Core :: JavaScript: Standard Library, defect)

Description

[Jeff Walden [:Waldo]]

ArrayIteratorNext begins like so:

function ArrayIteratorNext() {
    // FIXME: ArrayIterator prototype should not pass this test.  Bug 924059.
    if (!IsObject(this) || !IsArrayIterator(this))
        ThrowError(JSMSG_INCOMPATIBLE_METHOD, "ArrayIterator", "next", ToString(this));

which implies that

[jwalden@find-waldo-now src]$ dbg/js/src/js
js> var next = [1, 2, 3, 4, 5]['@@iterator']().next     
js> next.call({ toString: function() { throw 42; } }) 
uncaught exception: 42

which is wrong.

This is sort of another variety of bug 633623, except that seeing ToString instead of, say, DecompileArg makes it far more obvious.  (That, and I think DecompileArg sometimes may not actually invoke user-defined code, but when it does/doesn't isn't clear from a super-quick skim.)

At the least it seems to me this should change to DecompileArg, which has the slight virtue of not invoking a method (toString) that the user is somewhat likely to have defined.  The full fix probably wants to wait for bug 633623.

Comment 1

[André Bargull [:anba]]

No longer reproducible - Resolving as WFM.

js> var next = [1, 2, 3, 4, 5][Symbol.iterator]().next 
js> next.call({ toString: function() { throw 42; } })
typein:2:1 TypeError: CallArrayIteratorMethodIfWrapped method called on incompatible Object