924059 - ArrayIterator.prototype.next method domain fixups

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andy Wingo [:wingo]]

After bug 919948, there are a couple of bugs in the range of the ArrayIterator prototype "next" function:

  var iter = []['@@iterator']();

  // Should signal TypeError: ArrayIterator next called on incompatible <...>
  // Instead signals TypeError: a is undefined
  iter.next.call(iter.__proto__)

  // Should return { value: undefined, done: true }
  // Instead signals TypeError: ArrayIterator next called on incompatible [object Array Iterator]
  iter.next.call(newGlobal().eval('[]["@@iterator"]()'))

Comment 2

[Boris Zbarsky [:bzbarsky]]

I've spun off bug 1111170 on the cross-compartment bits and will focus this on the proto issue.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Give ArrayIterator and its prototype different JSClasses so we can't confuse them for each other

Comment 4

[Jeff Walden [:Waldo]]

Comment on attachment 8535982 [details] [diff] [review]
Give ArrayIterator and its prototype different JSClasses so we can't confuse them for each other

Review of attachment 8535982 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/tests/ecma_6/Array/iterator_edge_cases.js
@@ +5,5 @@
> +    try {
> +        iter.next.call(Object.getPrototypeOf(iter))
> +        throw new Error("Call did not throw");
> +    } catch (e) {
> +        assertEq(e.name, "TypeError");

|e instanceof TypeError| is slightly better/finer-grained, because of it restricting to just this realm/global.

@@ +6,5 @@
> +        iter.next.call(Object.getPrototypeOf(iter))
> +        throw new Error("Call did not throw");
> +    } catch (e) {
> +        assertEq(e.name, "TypeError");
> +        assertEq(e.message, "ArrayIterator next called on incompatible [object Array Iterator]");

*mutters about exact error message testing making js.msg changes obnoxious*

Comment 5

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/33a749faaa04 with those changes.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/33a749faaa04