float.prototype.toString() and valueOf() applied to Number does not throw a TypeError

VERIFIED FIXED

Status

Tamarin
Virtual Machine
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: Brent Baker, Assigned: Virgil Palanciuc)

Tracking

(Blocks: 1 bug)

unspecified
Bug Flags:
in-testsuite +
flashplayer-qrb +
flashplayer-bug -
flashplayer-triage +

Details

(Reporter)

Description

6 years ago
s4.6.2 states that the toString prototype should throw a TypeError if 'this' is not a float. 

1. If the this value is not a float value then throw a TypeError

Informative note: The toString function is not generic; it throws a TypeError exception if its this value is not a float object. Therefore, it cannot be transferred to other kinds of objects for use as a method.

This works as described if you try and apply float.prototype.toString to Object, TypeError is thrown.

However if you apply float.prototype.toString to Number no error is thrown

Testcase: as3/Types/Float/flt_4_6_2.as

Number.prototype.toString = float.prototype.toString;
var test_num:Number = 3.14131211;
print(test_num.toString()); // This should throw a TypeError
Flags: in-testsuite+
Flags: flashplayer-triage+
Flags: flashplayer-qrb?
Flags: flashplayer-bug-
(Reporter)

Comment 1

6 years ago
I have commented out the test since there is an issue with marking an ErrorTest as an expectedfail since the additional assert that what is returned is an error object is failing and there is no clean way to mark the failure.

brbaker (note to self): Make sure to uncomment the testcase when this is resolved.
Status: NEW → ASSIGNED
(Reporter)

Comment 2

6 years ago
float.prototype.valueOf() also does not throw a TypeError if it is applied to Number
test media: as3/Types/Float/flt_4_6_4.as (Also needed to comment out the test)
Summary: float.prototype.toString() applied to Number does not throw a TypeError → float.prototype.toString() and valueOf() applied to Number does not throw a TypeError
(Reporter)

Comment 3

6 years ago
Same issue applies to float4 (as3/Types/Float4/flt4_4_5_2.as)
(Assignee)

Comment 4

6 years ago
There's something else happening there. This one works fine (i.e. throws TypeError, with&without -Ojit/-Dinterp):
Number.prototype.toString = float.prototype.toString;
var test_num:Number = 3.14131211;
print(test_num.toString()); // This should throw a TypeError

However, in the testsuite, I can reproduce the problem. Can you please check that it's not testsuite-related? (ideally reproduce the issue in a small file)
(Reporter)

Comment 5

6 years ago
I am still seeing the issue; using float rev:237:69c054e96669 + asc.jar from Jeff's repo rev 48:446bcad0f4d1 (I am running OS X 64bit release-debugger and a debug shell)

Code:
var orig_tostr = Number.prototype.toString;
Number.prototype.toString = float.prototype.toString;
var test_num:Number = 3.14131211;
print(test_num.toString());
Number.prototype.toString = orig_tostr;

Output -Ojit and -Dinterp:
3.14131211

Expected Output:
TypeError: Error #1004: Method float.prototype.toString was invoked on an incompatible object.
(Assignee)

Comment 6

6 years ago
What is different from your setup?
=====================================================
Tamarin/tamarin-redux (hg:default,float4.codegen.diff) [ERROR#1] $ cat a1.as
var orig_tostr = Number.prototype.toString;
Number.prototype.toString = float.prototype.toString;
var test_num:Number = 3.14131211;
print(test_num.toString());
Number.prototype.toString = orig_tostr;
Tamarin/tamarin-redux (hg:default,float4.codegen.diff) $ ./platform/mac/avmshell/build/Release_Debugger64/avm -Ojit a1.abc
TypeError: Error #1004: Method float.prototype.toString was invoked on an incompatible object.
	at Error$/throwError()
	at Function/<anonymous>()
	at global$init()

Tamarin/tamarin-redux (hg:default,float4.codegen.diff) [ERROR#1] $ hg head
changeset:   6707:645f504eebfd

Tamarin/tamarin-redux (hg:default,float4.codegen.diff) [ERROR#1] $ ./platform/mac/avmshell/build/Release_Debugger64/avm -Dversion
shell 2.1 release-debugger build cyclone
features AVMSYSTEM_64BIT;AVMSYSTEM_UNALIGNED_INT_ACCESS;AVMSYSTEM_UNALIGNED_FP_ACCESS;AVMSYSTEM_LITTLE_ENDIAN;AVMSYSTEM_AMD64;AVMSYSTEM_MAC;AVMFEATURE_DEBUGGER;AVMFEATURE_ALLOCATION_SAMPLER;AVMFEATURE_JIT;AVMFEATURE_COMPILEPOLICY;AVMFEATURE_ABC_INTERP;AVMFEATURE_SELFTEST;AVMFEATURE_EVAL;AVMFEATURE_PROTECT_JITMEM;AVMFEATURE_SHARED_GCHEAP;AVMFEATURE_MEMORY_PROFILER;AVMFEATURE_CACHE_GQCN;AVMFEATURE_SAFEPOINTS;AVMFEATURE_SWF12;AVMFEATURE_SWF13;AVMFEATURE_SWF14;AVMFEATURE_SWF15;AVMFEATURE_SWF16;AVMTWEAK_EXACT_TRACING;

Compiled as: java -jar $ASC -import generated/builtin.abc -abcfuture a1.as
(with the asc that you mentioned)
=====================================================

(worth repeating: test with just this file, not the entire testsuite. Right? no other includes, or anything like that?)
(Reporter)

Comment 7

6 years ago
I think the issue is that it should be compiled with the -AS3 switch to asc
(Reporter)

Comment 8

6 years ago
testmedia was updated to ensure that both the prototype version and the AS3 version would be invoked when the -AS3 switch is used
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Flags: flashplayer-qrb? → flashplayer-qrb+
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.