Error messages for TypeErrors often decompile the wrong part of an expression

VERIFIED FIXED

Status

()

--
minor
VERIFIED FIXED
12 years ago
12 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

Trunk
PowerPC
Mac OS X
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

12 years ago
Here are five examples of TypeErrors decompiling the wrong part of an expression.  Brendan, if this should be multiple bug reports, please split them for me.

1
  js> function p() { return { toString: null } } "fafa".replace(/a/g, p)
  TypeError: can't convert "fafa".replace(/a/g, p) to string

2
  js> a=1; b=2; c={toString: null}; "hahbhc".replace(/[abc]/g, eval)
  TypeError: can't convert "hahbhc".replace(/[abc]/g, eval) to string

3
  js> 3 + ({toString:function(){yield 4} })
  TypeError: can't convert + to primitive type

4
  js> 3 + ({toString:({}) })                
  TypeError: + is not a function

5
  js> ([5].map)(3)
  TypeError: [5].map is not a function
(Reporter)

Comment 1

12 years ago
All 5 examples here are fixed by "prep patch for plan A" in bug 346642.  

* (1) and (2) now say "can't convert Object to string", which is reasonable, instead of trying to decompile something.

* (3), (4), and (5) now decompile the right thing.
Depends on: 346642
(Reporter)

Comment 2

12 years ago
This is still wrong...

6
  js> (1 + (4))()
  typein:8: TypeError: + is not a function
(Reporter)

Comment 3

12 years ago
(6) is good now too, with a newer patch.
(Reporter)

Comment 4

12 years ago
Fixed on trunk because "prep patch for plan A, v9d" in bug 346642 was checked in.
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED

Comment 5

12 years ago
Checking in regress-351503-01.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-01.js,v  <--  regress-351503-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-02.js,v
done
Checking in regress-351503-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-02.js,v  <--  regress-351503-02.js
initial revision: 1.1
done

-01 executes the tests at the top level while -02 executes them in the test() function.

$ /work/mozilla/builds/ff/trunk/mozilla/js/src/WINNT5.1_DBG.OBJ/js  -f ../shell.js -f regress-351503-01.js
BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
decompilation of TypeError messages: 1 PASSED
decompilation of TypeError messages: 2 PASSED
decompilation of TypeError messages: 3 PASSED
decompilation of TypeError messages: 4 PASSED
decompilation of TypeError messages: 5 PASSED
decompilation of TypeError messages: 6 PASSED


$ /work/mozilla/builds/ff/trunk/mozilla/js/src/WINNT5.1_DBG.OBJ/js  -f ../shell.js -f regress-351503-02.js
BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
decompilation of TypeError messages: 1 PASSED
FAILED!: decompilation of TypeError messages: 2
FAILED!: Expected value 'TypeError: can't convert Object to string', Actual value 'ReferenceError: a is not defined'
FAILED!: 
FAILED!: decompilation of TypeError messages: 3
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'No Error'
FAILED!: 
FAILED!: decompilation of TypeError messages: 4
FAILED!: Expected value 'TypeError: ({}) is not a function', Actual value 'No Error'
FAILED!: 
decompilation of TypeError messages: 5 PASSED
decompilation of TypeError messages: 6 PASSED
Flags: in-testsuite+
(Reporter)

Comment 6

12 years ago
I filed bug 353443 for #3 and #4.  Good catch!

Comment 7

12 years ago
removing the var makes #2 pass in regress-351503-02. brendan?
(Reporter)

Comment 8

12 years ago
#2 comes down to what scope "eval" called by replace should have:

js> (function() { var a="3"; return eval("a") })()
3

js> (function() { var a="3"; return "a".replace(/a/g, eval) })() 
strict warning: function eval must be called directly [...]
ReferenceError: a is not defined

Comment 9

12 years ago
ok. 

Checking in regress-351503-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-02.js,v  <--  regress-351503-02.js
new revision: 1.2; previous revision: 1.1
done

(In reply to comment #8)
> #2 comes down to what scope "eval" called by replace should have:
> 
> js> (function() { var a="3"; return eval("a") })()
> 3
> 
> js> (function() { var a="3"; return "a".replace(/a/g, eval) })() 
> strict warning: function eval must be called directly [...]
> ReferenceError: a is not defined

SpiderMonkey, like the Mocha runtime in Netscape 2 and 3 before it, has pre-ECMA indirect eval, which prepends the base object of the eval reference in the callee expression, b for b.eval(s), which is bound to |this| in the native eval method invocation, via an internal "with" statement, to the scope chain of the caller.

String.prototype.replace invokes its funarg with the parent of the function as the |this| parameter.  The parent is the global object.

/be

Comment 11

12 years ago
verified fixed 1.9 20060921 windows/mac*/linux
Jesse filed bug 353443 for failures in js1_7/regress/regress-351503-02.js #3, #4
Status: RESOLVED → VERIFIED

Comment 12

12 years ago
see bug 355052 with the same regression range of 2006-12-27,2007-12-28 on the trunk

js1_7/regress/regress-351503-01.js

FAILED!: decompilation of TypeError messages: 3 
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to 
FAILED!:  
FAILED!: decompilation of TypeError messages: 6 
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError:  +  is not a function' 
FAILED!:  

js1_7/regress/regress-351503-02.js

FAILED!: decompilation of TypeError messages: 3 
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to 
FAILED!:  
FAILED!: decompilation of TypeError messages: 6 
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError:  +  is not a function' 
FAILED!:  

Do we care?
Hmm, more seemingly cut off Actual values. Looks like a regression. Open a bug and cc: people on that hook.

/be

Comment 14

12 years ago
(In reply to comment #13)
> Hmm, more seemingly cut off Actual values. Looks like a regression. Open a bug
> and cc: people on that hook.

Bug 372364

partly user error partly real cut off or mangling or whatever.

js1_7/regress/regress-351503-01.js

BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
PASSED! decompilation of TypeError messages: 1
PASSED! decompilation of TypeError messages: 2
FAILED!: decompilation of TypeError messages: 3
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to primitive type'
FAILED!:
PASSED! decompilation of TypeError messages: 4
PASSED! decompilation of TypeError messages: 5
FAILED!: decompilation of TypeError messages: 6
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError: + is not a function'
FAILED!: 

js1_7/regress/regress-351503-02.js

BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
PASSED! decompilation of TypeError messages: 1
PASSED! decompilation of TypeError messages: 2
FAILED!: decompilation of TypeError messages: 3
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to primitive type'
FAILED!:
PASSED! decompilation of TypeError messages: 4
PASSED! decompilation of TypeError messages: 5
FAILED!: decompilation of TypeError messages: 6
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError: + is not a function'
FAILED!: 
You need to log in before you can comment on or make changes to this bug.