1111170 - ArrayIteratorPrototype.next and StringIteratorPrototype.next should work on cross-compartment wrappers for iterators

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Spun off from bug 924059.  Testcase:

  var iter = [][Symbol.iterator]();
  // Should return { value: undefined, done: true }
  // Instead signals TypeError: ArrayIterator next called on incompatible [object Array Iterator]
  iter.next.call(newGlobal().eval('[][Symbol.iterator]()'))

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: testcases

Comment 2

[Boris Zbarsky [:bzbarsky]]

The only sane implementation thought I've had so far is to have some way to say 

  If this object does not have the expected class, then:
    1) If it's not a wrapper, throw.
    2) If we can't js::CheckedUnwrap, throw.
    3) Delegate to this same method in the compartment of the underlying object.
    4) Re-wrap the value on its way out.

Presumably this would be some intrinsic we call...  Step 3 is the interesting one.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Make ArrayIterator and StringIterator next() methods work even with cross-compartment wrappers for those objects as this values

Comment 4

[Jeff Walden [:Waldo]]

Comment on attachment 8535987 [details] [diff] [review]
Make ArrayIterator and StringIterator next() methods work even with cross-compartment wrappers for those objects as this values

Review of attachment 8535987 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/tests/ecma_6/String/iterator_edge_cases.js
@@ +1,1 @@
> +// Tests that we can use %StringIteratorPrototype%.next on a

Would be nice duplicating the ArrayIterator confusion test over here, too.  %StringIteratorPrototype% too is an ordinary object, so it all should apply mutatis mutandis.

::: js/src/vm/SelfHosting.cpp
@@ +1102,5 @@
>  
>      JS_FN("NewArrayIterator",        intrinsic_NewArrayIterator,        0,0),
>      JS_FN("IsArrayIterator",         intrinsic_IsArrayIterator,         1,0),
> +    JS_FN("CallArrayIteratorMethodIfWrapped",
> +          CallNonGenericSelfhostedMethod<Is<ArrayIteratorObject>>, 2, 0),

I guess we want the 2 aligned underneath the 1 two lines up.  Same below.

Comment 5

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5e513880db47

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5e513880db47