Closed Bug 351503 Opened 18 years ago Closed 18 years ago

Error messages for TypeErrors often decompile the wrong part of an expression

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
PowerPC
macOS
Type:
defect
Priority:
Not set
Severity:
minor

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

Here are five examples of TypeErrors decompiling the wrong part of an expression.  Brendan, if this should be multiple bug reports, please split them for me.

1
  js> function p() { return { toString: null } } "fafa".replace(/a/g, p)
  TypeError: can't convert "fafa".replace(/a/g, p) to string

2
  js> a=1; b=2; c={toString: null}; "hahbhc".replace(/[abc]/g, eval)
  TypeError: can't convert "hahbhc".replace(/[abc]/g, eval) to string

3
  js> 3 + ({toString:function(){yield 4} })
  TypeError: can't convert + to primitive type

4
  js> 3 + ({toString:({}) })                
  TypeError: + is not a function

5
  js> ([5].map)(3)
  TypeError: [5].map is not a function
All 5 examples here are fixed by "prep patch for plan A" in bug 346642.  

* (1) and (2) now say "can't convert Object to string", which is reasonable, instead of trying to decompile something.

* (3), (4), and (5) now decompile the right thing.
Depends on: desdec
This is still wrong...

6
  js> (1 + (4))()
  typein:8: TypeError: + is not a function

(6) is good now too, with a newer patch.
Fixed on trunk because "prep patch for plan A, v9d" in bug 346642 was checked in.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Checking in regress-351503-01.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-01.js,v  <--  regress-351503-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-02.js,v
done
Checking in regress-351503-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-02.js,v  <--  regress-351503-02.js
initial revision: 1.1
done

-01 executes the tests at the top level while -02 executes them in the test() function.

$ /work/mozilla/builds/ff/trunk/mozilla/js/src/WINNT5.1_DBG.OBJ/js  -f ../shell.js -f regress-351503-01.js
BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
decompilation of TypeError messages: 1 PASSED
decompilation of TypeError messages: 2 PASSED
decompilation of TypeError messages: 3 PASSED
decompilation of TypeError messages: 4 PASSED
decompilation of TypeError messages: 5 PASSED
decompilation of TypeError messages: 6 PASSED


$ /work/mozilla/builds/ff/trunk/mozilla/js/src/WINNT5.1_DBG.OBJ/js  -f ../shell.js -f regress-351503-02.js
BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
decompilation of TypeError messages: 1 PASSED
FAILED!: decompilation of TypeError messages: 2
FAILED!: Expected value 'TypeError: can't convert Object to string', Actual value 'ReferenceError: a is not defined'
FAILED!: 
FAILED!: decompilation of TypeError messages: 3
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'No Error'
FAILED!: 
FAILED!: decompilation of TypeError messages: 4
FAILED!: Expected value 'TypeError: ({}) is not a function', Actual value 'No Error'
FAILED!: 
decompilation of TypeError messages: 5 PASSED
decompilation of TypeError messages: 6 PASSED
Flags: in-testsuite+
I filed bug 353443 for #3 and #4.  Good catch!
removing the var makes #2 pass in regress-351503-02. brendan?
#2 comes down to what scope "eval" called by replace should have:

js> (function() { var a="3"; return eval("a") })()
3

js> (function() { var a="3"; return "a".replace(/a/g, eval) })() 
strict warning: function eval must be called directly [...]
ReferenceError: a is not defined

ok. 

Checking in regress-351503-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-351503-02.js,v  <--  regress-351503-02.js
new revision: 1.2; previous revision: 1.1
done


(In reply to comment #8)
> #2 comes down to what scope "eval" called by replace should have:
> 
> js> (function() { var a="3"; return eval("a") })()
> 3
> 
> js> (function() { var a="3"; return "a".replace(/a/g, eval) })() 
> strict warning: function eval must be called directly [...]
> ReferenceError: a is not defined

SpiderMonkey, like the Mocha runtime in Netscape 2 and 3 before it, has pre-ECMA indirect eval, which prepends the base object of the eval reference in the callee expression, b for b.eval(s), which is bound to |this| in the native eval method invocation, via an internal "with" statement, to the scope chain of the caller.

String.prototype.replace invokes its funarg with the parent of the function as the |this| parameter.  The parent is the global object.

/be

verified fixed 1.9 20060921 windows/mac*/linux
Jesse filed bug 353443 for failures in js1_7/regress/regress-351503-02.js #3, #4
Status: RESOLVED → VERIFIED
see bug 355052 with the same regression range of 2006-12-27,2007-12-28 on the trunk

js1_7/regress/regress-351503-01.js

FAILED!: decompilation of TypeError messages: 3 
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to 
FAILED!:  
FAILED!: decompilation of TypeError messages: 6 
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError:  +  is not a function' 
FAILED!:  

js1_7/regress/regress-351503-02.js

FAILED!: decompilation of TypeError messages: 3 
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to 
FAILED!:  
FAILED!: decompilation of TypeError messages: 6 
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError:  +  is not a function' 
FAILED!:  

Do we care?
Hmm, more seemingly cut off Actual values. Looks like a regression. Open a bug and cc: people on that hook.

/be
(In reply to comment #13)
> Hmm, more seemingly cut off Actual values. Looks like a regression. Open a bug
> and cc: people on that hook.

Bug 372364

partly user error partly real cut off or mangling or whatever.

js1_7/regress/regress-351503-01.js

BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
PASSED! decompilation of TypeError messages: 1
PASSED! decompilation of TypeError messages: 2
FAILED!: decompilation of TypeError messages: 3
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to primitive type'
FAILED!:
PASSED! decompilation of TypeError messages: 4
PASSED! decompilation of TypeError messages: 5
FAILED!: decompilation of TypeError messages: 6
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError: + is not a function'
FAILED!: 

js1_7/regress/regress-351503-02.js

BUGNUMBER: 351503
STATUS: decompilation of TypeError messages
PASSED! decompilation of TypeError messages: 1
PASSED! decompilation of TypeError messages: 2
FAILED!: decompilation of TypeError messages: 3
FAILED!: Expected value 'TypeError: can't convert ({toString:(function () {yield 4;})}) to primitive type', Actual value 'TypeError: can't convert { to primitive type'
FAILED!:
PASSED! decompilation of TypeError messages: 4
PASSED! decompilation of TypeError messages: 5
FAILED!: decompilation of TypeError messages: 6
FAILED!: Expected value 'TypeError: 5 is not a function', Actual value 'TypeError: + is not a function'
FAILED!:
You need to log in before you can comment on or make changes to this bug.