If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Wrong argument index for DecompileArg

NEW
Unassigned

Status

()

Core
JavaScript: Standard Library
2 years ago
2 years ago

People

(Reporter: André Bargull, Unassigned)

Tracking

Trunk
Points:
---

Firefox Tracking Flags

(firefox43 affected)

Details

(Reporter)

Description

2 years ago
Test case:
---
Number.prototype.from = Int8Array.from;
0..from([], 1)
---

Expected: Throws TypeError with message "0 is not a constructor"
Actual: Throws TypeError with message "1 is not a constructor"

http://hg.mozilla.org/mozilla-central/file/f61c3cc0eb8b/js/src/builtin/TypedArray.js#l1009

>  ThrowTypeError(JSMSG_NOT_CONSTRUCTOR, DecompileArg(1, C));





There is also:

http://hg.mozilla.org/mozilla-central/file/f61c3cc0eb8b/js/src/builtin/TypedObject.js#l947

> ThrowTypeError(JSMSG_NOT_FUNCTION, DecompileArg(0, maybeFunc));

This could be changed to "DecompileArg(2, maybeFunc)", or probably just "assert(IsCallable(maybeFunc))", because both callers to MapUntypedSeqImpl already check IsCallable.

Comment 1

2 years ago
Hello, I would like to work on this bug
You need to log in before you can comment on or make changes to this bug.