From ae1b497c229bd1fd522f05c1a76f6c4bc0e5d5a2 Mon Sep 17 00:00:00 2001 From: Ryan VanderMeulen Date: Fri, 1 May 2015 09:30:44 -0400 Subject: [PATCH] Backed out 3 changesets (bug 1155900) for frequent browser_net_cached-status.js failures. CLOSED TREE Backed out changeset 8b3bb908f6fc (bug 1155900) Backed out changeset 195a3736c877 (bug 1155900) Backed out changeset 5d7b3b8cce5a (bug 1155900) --- .../netmonitor/test/browser_net_charts-01.js | 2 +- js/src/frontend/BytecodeEmitter.cpp | 38 ++------- js/src/frontend/BytecodeEmitter.h | 3 - .../tests/basic/destructuring-default.js | 2 +- ...cturing-toobject-before-iterator-lookup.js | 80 ------------------- .../tests/basic/destructuring-toobject.js | 36 --------- .../tests/basic/expression-autopsy.js | 27 +------ .../for-of-primitive-with-iterator-hooked.js | 32 -------- ...egating-yield-getiterator-does-toobject.js | 58 -------------- .../tests/js1_8/regress/regress-469625-03.js | 4 +- .../js1_8_5/extensions/decompile-for-of.js | 2 +- .../tests/js1_8_5/regress/regress-592202-1.js | 12 +-- js/src/vm/CommonPropertyNames.h | 1 - js/src/vm/Interpreter.cpp | 1 + 14 files changed, 18 insertions(+), 280 deletions(-) delete mode 100644 js/src/jit-test/tests/basic/destructuring-toobject-before-iterator-lookup.js delete mode 100644 js/src/jit-test/tests/basic/destructuring-toobject.js delete mode 100644 js/src/jit-test/tests/for-of/for-of-primitive-with-iterator-hooked.js delete mode 100644 js/src/tests/ecma_6/Generators/delegating-yield-getiterator-does-toobject.js diff --git a/browser/devtools/netmonitor/test/browser_net_charts-01.js b/browser/devtools/netmonitor/test/browser_net_charts-01.js index fef991a5dc51..985f4913aac6 100644 --- a/browser/devtools/netmonitor/test/browser_net_charts-01.js +++ b/browser/devtools/netmonitor/test/browser_net_charts-01.js @@ -6,7 +6,7 @@ // Whitelisting this test. // As part of bug 1077403, the leaking uncaught rejection should be fixed. // -thisTestLeaksUncaughtRejectionsAndShouldBeFixed("TypeError: can't convert undefined to object"); +thisTestLeaksUncaughtRejectionsAndShouldBeFixed("TypeError: aValue.content is undefined"); /** * Makes sure Pie Charts have the right internal structure. diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp index 47e96c1c7ca5..0ffd472883d7 100644 --- a/js/src/frontend/BytecodeEmitter.cpp +++ b/js/src/frontend/BytecodeEmitter.cpp @@ -3726,10 +3726,7 @@ BytecodeEmitter::emitDestructuringOpsObjectHelper(ParseNode* pattern, VarEmitOpt MOZ_ASSERT(pattern->isKind(PNK_OBJECT)); MOZ_ASSERT(pattern->isArity(PN_LIST)); - MOZ_ASSERT(this->stackDepth != 0); // ... RHS - - if (!emitToObject()) // ... OBJ - return false; + MOZ_ASSERT(this->stackDepth != 0); // ... OBJ for (ParseNode* member = pattern->pn_head; member; member = member->pn_next) { // Duplicate the value being destructured to use as a reference base. @@ -4955,40 +4952,17 @@ BytecodeEmitter::emitWith(ParseNode* pn) return true; } -bool -BytecodeEmitter::emitToObject() -{ - if (!emitAtomOp(cx->names().ToObject, JSOP_GETINTRINSIC)) // VAL TOOBJECT - return false; - if (!emit1(JSOP_UNDEFINED)) // VAL TOOBJECT UNDEFINED - return false; - if (!emit2(JSOP_PICK, (jsbytecode)2)) // TOOBJECT UNDEFINED VAL - return false; - if (!emitCall(JSOP_CALL, 1)) // OBJ - return false; - checkTypeSet(JSOP_CALL); - return true; -} - bool BytecodeEmitter::emitIterator() { - // Convert iterable to iterator, consistent with GetIterator. - // - // Note that what we call VAL, the spec calls |obj|. The value isn't - // necessarily an object! |GetMethod(obj, @@iterator)| implies a ToObject - // call during the effective |obj[@@iterator]()|, but that object-for-real - // is discarded after the method lookup. So we call the iterator function - // with the originally-provided value. - if (!emit1(JSOP_DUP)) // VAL VAL + // Convert iterable to iterator. + if (!emit1(JSOP_DUP)) // OBJ OBJ return false; - if (!emitToObject()) // VAL OBJ + if (!emit2(JSOP_SYMBOL, jsbytecode(JS::SymbolCode::iterator))) // OBJ OBJ @@ITERATOR return false; - if (!emit2(JSOP_SYMBOL, jsbytecode(JS::SymbolCode::iterator))) // VAL OBJ @@ITERATOR + if (!emitElemOpBase(JSOP_CALLELEM)) // OBJ ITERFN return false; - if (!emitElemOpBase(JSOP_CALLELEM)) // VAL ITERFN - return false; - if (!emit1(JSOP_SWAP)) // ITERFN VAL + if (!emit1(JSOP_SWAP)) // ITERFN OBJ return false; if (!emitCall(JSOP_CALL, 0)) // ITER return false; diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h index 786a1b627704..f3e38612868b 100644 --- a/js/src/frontend/BytecodeEmitter.h +++ b/js/src/frontend/BytecodeEmitter.h @@ -524,9 +524,6 @@ struct BytecodeEmitter // the stack. bool emitInitializeDestructuringDecls(JSOp prologueOp, ParseNode* pattern); - // Convert the value atop the stack to an object using ToObject. - bool emitToObject(); - // emitIterator expects the iterable to already be on the stack. // It will replace that stack value with the corresponding iterator bool emitIterator(); diff --git a/js/src/jit-test/tests/basic/destructuring-default.js b/js/src/jit-test/tests/basic/destructuring-default.js index 4548f39fcb0b..82629c09f97c 100644 --- a/js/src/jit-test/tests/basic/destructuring-default.js +++ b/js/src/jit-test/tests/basic/destructuring-default.js @@ -157,7 +157,7 @@ assertEq(a.y, 2); // defaults are evaluated even if there is no binding var evaled = false; -({a: {} = (evaled = true, {})}) = {}; +({a: {} = (evaled = true, null)}) = {}; assertEq(evaled, true); evaled = false; assertThrowsInstanceOf(() => { [[] = (evaled = true, 2)] = [] }, TypeError); diff --git a/js/src/jit-test/tests/basic/destructuring-toobject-before-iterator-lookup.js b/js/src/jit-test/tests/basic/destructuring-toobject-before-iterator-lookup.js deleted file mode 100644 index a87589383dc6..000000000000 --- a/js/src/jit-test/tests/basic/destructuring-toobject-before-iterator-lookup.js +++ /dev/null @@ -1,80 +0,0 @@ -// Test that looking up a supposedly-iterable value's @@iterator property -// first boxes up the value into an object via ToObject, then gets the -// @@iterator using the object as receiver. Cover most of the cases where the -// frontend effects a GetIterator call. (The remaining frontend cases are -// handled in other tests in the revision that introduced this file. -// Non-frontend cases aren't tested here.) -"use strict"; - -load(libdir + 'asserts.js'); -load(libdir + 'eqArrayHelper.js'); - -Object.defineProperty(Boolean.prototype, Symbol.iterator, -{ - get() { - assertEq(typeof this, "object", - "GetMethod(obj, @@iterator) internally first performs ToObject"); - assertEq(this !== null, true, - "this is really an object, not null"); - - function FakeBooleanIterator() - { - assertEq(typeof this, "boolean", - "iterator creation code must perform ToObject(false) before " + - "doing a lookup for @@iterator"); - - var count = 0; - return { next() { - if (count++ > 0) - throw new Error("unexpectedly called twice"); - return { done: true }; - } }; - - } - - return FakeBooleanIterator; - }, - configurable: true -}); - -function destructuringAssignment() -{ - ([] = false); - ([,] = false); -} -for (var i = 0; i < 10; i++) - destructuringAssignment(); - -function spreadElements() -{ - var arr1 = [...false]; - assertEqArray(arr1, []); - - var arr2 = [1, ...false]; - assertEqArray(arr2, [1]); - - var arr3 = [1, ...false, 2]; - assertEqArray(arr3, [1, 2]); -} -for (var i = 0; i < 10; i++) - spreadElements(); - -function spreadCall() -{ - var arr1 = new Array(...false); - assertEqArray(arr1, []); - - var arr2 = new Array(0, ...false); - assertEqArray(arr2, []); - - var arr3 = new Array(1, 2, ...false); - assertEqArray(arr3, [1, 2]); -} -for (var i = 0; i < 10; i++) - spreadCall(); - -function destructuringArgument([]) -{ -} -for (var i = 0; i < 10; i++) - destructuringArgument(false); diff --git a/js/src/jit-test/tests/basic/destructuring-toobject.js b/js/src/jit-test/tests/basic/destructuring-toobject.js deleted file mode 100644 index bac5839ccb9e..000000000000 --- a/js/src/jit-test/tests/basic/destructuring-toobject.js +++ /dev/null @@ -1,36 +0,0 @@ -load(libdir + 'asserts.js'); -load(libdir + 'iteration.js'); - -function f(v) -{ - if (v + "") - ({} = v); -} - -f(true); -f({}); -assertThrowsInstanceOf(() => f(null), TypeError); -assertThrowsInstanceOf(() => f(undefined), TypeError); - -function g(v) -{ - if (v + "") - ({} = v); -} - -g(true); -g({}); -assertThrowsInstanceOf(() => g(undefined), TypeError); -assertThrowsInstanceOf(() => g(null), TypeError); - -function h(v) -{ - if (v + "") - ([] = v); -} - -h([true]); -h("foo"); -assertThrowsInstanceOf(() => h(undefined), TypeError); -assertThrowsInstanceOf(() => h(null), TypeError); - diff --git a/js/src/jit-test/tests/basic/expression-autopsy.js b/js/src/jit-test/tests/basic/expression-autopsy.js index 3e23a685d4aa..ad6f7bf0494c 100644 --- a/js/src/jit-test/tests/basic/expression-autopsy.js +++ b/js/src/jit-test/tests/basic/expression-autopsy.js @@ -111,31 +111,12 @@ check("o[- (o)]"); // A few one off tests check_one("6", (function () { 6() }), " is not a function"); check_one("0", (function () { Array.prototype.reverse.call('123'); }), " is read-only"); +check_one(`(intermediate value)[Symbol.iterator](...).next(...).value`, + function () { var [{ x }] = [null, {}]; }, " is null"); +check_one(`(intermediate value)[Symbol.iterator](...).next(...).value`, + function () { ieval("let (x) { var [a, b, [c0, c1]] = [x, x, x]; }") }, " is undefined"); check_one("void 1", function() { (void 1)(); }, " is not a function"); check_one("void o[1]", function() { var o = []; (void o[1])() }, " is not a function"); -// Manual testing for a few isolated cases. In these instances, the only way -// to trigger an error is *not* on an attempted property access during -// destructuring, but during a preceding ToObject() call on the value to be -// iterated. And the error message for failed ToObject(...) is different: -// "can't convert {0} to object". -function checkCantConvert(f, valstr) -{ - try - { - f(); - throw new Error("didn't throw"); - } - catch (e) - { - assertEq(e instanceof TypeError, true, - "expected TypeError, got " + e + " for function " + f); - assertEq(e.message, "can't convert " + valstr + " to object"); - } -} - -checkCantConvert(function() { var [{x}] = [null, {}]; }, "null"); -checkCantConvert(function () { ieval("let (x) { var [a, b, [c0, c1]] = [x, x, x]; }") }, "undefined"); - // Check fallback behavior assertThrowsInstanceOf(function () { for (let x of undefined) {} }, TypeError); diff --git a/js/src/jit-test/tests/for-of/for-of-primitive-with-iterator-hooked.js b/js/src/jit-test/tests/for-of/for-of-primitive-with-iterator-hooked.js deleted file mode 100644 index 01ec591bfe25..000000000000 --- a/js/src/jit-test/tests/for-of/for-of-primitive-with-iterator-hooked.js +++ /dev/null @@ -1,32 +0,0 @@ -// Test that looking up a supposedly-iterable value's @@iterator property -// first boxes up the value into an object via ToObject, then gets the -// @@iterator using the object as receiver. Cover only the for-of case: other -// cases are handled elsewhere in the revision that introduced this test. -"use strict"; - -load(libdir + 'asserts.js'); -load(libdir + 'iteration.js'); - -Object.defineProperty(Boolean.prototype, Symbol.iterator, -{ - get() { - assertEq(typeof this, "object", - "GetMethod(obj, @@iterator) internally first performs ToObject"); - assertEq(this !== null, true, - "this is really an object, not null"); - - function FakeBooleanIterator() - { - assertEq(typeof this, "boolean", - "iterator creation code must perform ToObject(false) before " + - "doing a lookup for @@iterator"); - return { next() { return { done: true }; } }; - } - - return FakeBooleanIterator; - }, - configurable: true -}); - -for (var i of false) - assertEq(true, false, "not reached"); diff --git a/js/src/tests/ecma_6/Generators/delegating-yield-getiterator-does-toobject.js b/js/src/tests/ecma_6/Generators/delegating-yield-getiterator-does-toobject.js deleted file mode 100644 index 57f99ed93a49..000000000000 --- a/js/src/tests/ecma_6/Generators/delegating-yield-getiterator-does-toobject.js +++ /dev/null @@ -1,58 +0,0 @@ -// With yield*, the GetIterator call on the provided value looks up the -// @@iterator property on ToObject(value), not on a possibly-primitive value. -"use strict"; - -Object.defineProperty(Boolean.prototype, Symbol.iterator, -{ - get() { - assertEq(typeof this, "object", - "GetMethod(obj, @@iterator) internally first performs ToObject"); - assertEq(this !== null, true, - "this is really an object, not null"); - - function FakeBooleanIterator() - { - assertEq(typeof this, "boolean", - "iterator creation code must perform ToObject(false) before " + - "doing a lookup for @@iterator"); - - var count = 0; - return { next() { - if (count++ > 0) - throw new Error("unexpectedly called twice"); - return { done: true }; - } }; - - } - - return FakeBooleanIterator; - }, - configurable: true -}); - -function* f() -{ - yield 1; - yield* false; - yield 2; -} - -for (var i = 0; i < 10; i++) -{ - var gen = f(); - - var first = gen.next(); - assertEq(first.done, false); - assertEq(first.value, 1); - - var second = gen.next(); - assertEq(second.done, false); - assertEq(second.value, 2); - - var last = gen.next(); - assertEq(last.done, true); - assertEq(last.value, undefined); -} - -if (typeof reportCompare === "function") - reportCompare(true, true); diff --git a/js/src/tests/js1_8/regress/regress-469625-03.js b/js/src/tests/js1_8/regress/regress-469625-03.js index a451f445e388..1e2d46cba9e1 100644 --- a/js/src/tests/js1_8/regress/regress-469625-03.js +++ b/js/src/tests/js1_8/regress/regress-469625-03.js @@ -26,8 +26,8 @@ function test() var [a, b, [c0, c1]] = [x, x, x]; } - expect = "TypeError: can't convert null to object"; - actual = "No Error"; + expect = `TypeError: (intermediate value)[Symbol.iterator](...).next(...).value is null`; + actual = 'No Error'; try { f(null); diff --git a/js/src/tests/js1_8_5/extensions/decompile-for-of.js b/js/src/tests/js1_8_5/extensions/decompile-for-of.js index e2a8c812f6e4..aab32da1491e 100644 --- a/js/src/tests/js1_8_5/extensions/decompile-for-of.js +++ b/js/src/tests/js1_8_5/extensions/decompile-for-of.js @@ -9,7 +9,7 @@ function check(code) { s = exc.message; } - assertEq(s, "(intermediate value)(...)[Symbol.iterator] is not a function"); + assertEq(s, `x[Symbol.iterator] is not a function`); } x = {}; diff --git a/js/src/tests/js1_8_5/regress/regress-592202-1.js b/js/src/tests/js1_8_5/regress/regress-592202-1.js index bbed53021ba1..a688c56db639 100644 --- a/js/src/tests/js1_8_5/regress/regress-592202-1.js +++ b/js/src/tests/js1_8_5/regress/regress-592202-1.js @@ -2,14 +2,6 @@ * Any copyright is dedicated to the Public Domain. * http://creativecommons.org/licenses/publicdomain/ */ -i = 42; -eval("let (y) { \n" + - " (function() { \n" + - " let ({} = (y, {})) { \n" + - " (function() { \n" + - " let ({} = y = []) (i); \n" + - " })(); \n" + - " } \n" + - " })(); \n" + - "}"); +i = 42 +eval("let(y){(function(){let({}=y){(function(){let({}=y=[])(i)})()}})()}") reportCompare(0, 0, "ok"); diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h index a4caf09059c7..9812b14f1037 100644 --- a/js/src/vm/CommonPropertyNames.h +++ b/js/src/vm/CommonPropertyNames.h @@ -201,7 +201,6 @@ macro(toISOString, toISOString, "toISOString") \ macro(toJSON, toJSON, "toJSON") \ macro(toLocaleString, toLocaleString, "toLocaleString") \ - macro(ToObject, ToObject, "ToObject") \ macro(toSource, toSource, "toSource") \ macro(toString, toString, "toString") \ macro(toUTCString, toUTCString, "toUTCString") \ diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp index 42edeece8aa3..b486ca181616 100644 --- a/js/src/vm/Interpreter.cpp +++ b/js/src/vm/Interpreter.cpp @@ -206,6 +206,7 @@ NoSuchMethod(JSContext* cx, unsigned argc, Value* vp) return false; MOZ_ASSERT(vp[0].isObject()); + MOZ_ASSERT(vp[1].isObject()); NativeObject* obj = &vp[0].toObject().as(); MOZ_ASSERT(obj->getClass() == &js_NoSuchMethodClass);