Backed out 3 changesets (bug 1155900) for frequent browser_net_cached-status.js failures. CLOSED TREE

Backed out changeset 8b3bb908f6fc (bug 1155900)
Backed out changeset 195a3736c877 (bug 1155900)
Backed out changeset 5d7b3b8cce5a (bug 1155900)

browser/devtools/netmonitor/test/browser_net_charts-01.js

@@ -6,7 +6,7 @@
 // Whitelisting this test.
 // As part of bug 1077403, the leaking uncaught rejection should be fixed.
 //
-thisTestLeaksUncaughtRejectionsAndShouldBeFixed("TypeError: can't convert undefined to object");
+thisTestLeaksUncaughtRejectionsAndShouldBeFixed("TypeError: aValue.content is undefined");
 
 /**
  * Makes sure Pie Charts have the right internal structure.

js/src/frontend/BytecodeEmitter.cpp

@@ -3726,10 +3726,7 @@ BytecodeEmitter::emitDestructuringOpsObjectHelper(ParseNode* pattern, VarEmitOpt
     MOZ_ASSERT(pattern->isKind(PNK_OBJECT));
     MOZ_ASSERT(pattern->isArity(PN_LIST));
 
-    MOZ_ASSERT(this->stackDepth != 0);                            // ... RHS
-
-    if (!emitToObject())                                          // ... OBJ
-        return false;
+    MOZ_ASSERT(this->stackDepth != 0);                            // ... OBJ
 
     for (ParseNode* member = pattern->pn_head; member; member = member->pn_next) {
         // Duplicate the value being destructured to use as a reference base.
@@ -4955,40 +4952,17 @@ BytecodeEmitter::emitWith(ParseNode* pn)
     return true;
 }
 
-bool
-BytecodeEmitter::emitToObject()
-{
-    if (!emitAtomOp(cx->names().ToObject, JSOP_GETINTRINSIC)) // VAL TOOBJECT
-        return false;
-    if (!emit1(JSOP_UNDEFINED))                               // VAL TOOBJECT UNDEFINED
-        return false;
-    if (!emit2(JSOP_PICK, (jsbytecode)2))                     // TOOBJECT UNDEFINED VAL
-        return false;
-    if (!emitCall(JSOP_CALL, 1))                              // OBJ
-        return false;
-    checkTypeSet(JSOP_CALL);
-    return true;
-}
-
 bool
 BytecodeEmitter::emitIterator()
 {
-    // Convert iterable to iterator, consistent with GetIterator.
-    //
-    // Note that what we call VAL, the spec calls |obj|.  The value isn't
-    // necessarily an object!  |GetMethod(obj, @@iterator)| implies a ToObject
-    // call during the effective |obj[@@iterator]()|, but that object-for-real
-    // is discarded after the method lookup.  So we call the iterator function
-    // with the originally-provided value.
-    if (!emit1(JSOP_DUP))                                 // VAL VAL
+    // Convert iterable to iterator.
+    if (!emit1(JSOP_DUP))                                 // OBJ OBJ
         return false;
-    if (!emitToObject())                                  // VAL OBJ
+    if (!emit2(JSOP_SYMBOL, jsbytecode(JS::SymbolCode::iterator))) // OBJ OBJ @@ITERATOR
         return false;
-    if (!emit2(JSOP_SYMBOL, jsbytecode(JS::SymbolCode::iterator))) // VAL OBJ @@ITERATOR
+    if (!emitElemOpBase(JSOP_CALLELEM))                   // OBJ ITERFN
         return false;
-    if (!emitElemOpBase(JSOP_CALLELEM))                   // VAL ITERFN
-        return false;
-    if (!emit1(JSOP_SWAP))                                // ITERFN VAL
+    if (!emit1(JSOP_SWAP))                                // ITERFN OBJ
         return false;
     if (!emitCall(JSOP_CALL, 0))                          // ITER
         return false;

js/src/frontend/BytecodeEmitter.h

@@ -524,9 +524,6 @@ struct BytecodeEmitter
     // the stack.
     bool emitInitializeDestructuringDecls(JSOp prologueOp, ParseNode* pattern);
 
-    // Convert the value atop the stack to an object using ToObject.
-    bool emitToObject();
-
     // emitIterator expects the iterable to already be on the stack.
     // It will replace that stack value with the corresponding iterator
     bool emitIterator();

js/src/jit-test/tests/basic/destructuring-default.js

@@ -157,7 +157,7 @@ assertEq(a.y, 2);
 
 // defaults are evaluated even if there is no binding
 var evaled = false;
-({a: {} = (evaled = true, {})}) = {};
+({a: {} = (evaled = true, null)}) = {};
 assertEq(evaled, true);
 evaled = false;
 assertThrowsInstanceOf(() => { [[] = (evaled = true, 2)] = [] }, TypeError);

js/src/jit-test/tests/basic/destructuring-toobject-before-iterator-lookup.js

@@ -1,80 +0,0 @@
-// Test that looking up a supposedly-iterable value's @@iterator property
-// first boxes up the value into an object via ToObject, then gets the
-// @@iterator using the object as receiver.  Cover most of the cases where the
-// frontend effects a GetIterator call.  (The remaining frontend cases are
-// handled in other tests in the revision that introduced this file.
-// Non-frontend cases aren't tested here.)
-"use strict";
-
-load(libdir + 'asserts.js');
-load(libdir + 'eqArrayHelper.js');
-
-Object.defineProperty(Boolean.prototype, Symbol.iterator,
-{
-  get() {
-    assertEq(typeof this, "object",
-             "GetMethod(obj, @@iterator) internally first performs ToObject");
-    assertEq(this !== null, true,
-             "this is really an object, not null");
-
-    function FakeBooleanIterator()
-    {
-      assertEq(typeof this, "boolean",
-               "iterator creation code must perform ToObject(false) before " +
-               "doing a lookup for @@iterator");
-
-      var count = 0;
-      return { next() {
-                 if (count++ > 0)
-                   throw new Error("unexpectedly called twice");
-                 return { done: true };
-               } };
-
-    }
-
-    return FakeBooleanIterator;
-  },
-  configurable: true
-});
-
-function destructuringAssignment()
-{
-  ([] = false);
-  ([,] = false);
-}
-for (var i = 0; i < 10; i++)
-  destructuringAssignment();
-
-function spreadElements()
-{
-  var arr1 = [...false];
-  assertEqArray(arr1, []);
-
-  var arr2 = [1, ...false];
-  assertEqArray(arr2, [1]);
-
-  var arr3 = [1, ...false, 2];
-  assertEqArray(arr3, [1, 2]);
-}
-for (var i = 0; i < 10; i++)
-  spreadElements();
-
-function spreadCall()
-{
-  var arr1 = new Array(...false);
-  assertEqArray(arr1, []);
-
-  var arr2 = new Array(0, ...false);
-  assertEqArray(arr2, []);
-
-  var arr3 = new Array(1, 2, ...false);
-  assertEqArray(arr3, [1, 2]);
-}
-for (var i = 0; i < 10; i++)
-  spreadCall();
-
-function destructuringArgument([])
-{
-}
-for (var i = 0; i < 10; i++)
-  destructuringArgument(false);

js/src/jit-test/tests/basic/destructuring-toobject.js

@@ -1,36 +0,0 @@
-load(libdir + 'asserts.js');
-load(libdir + 'iteration.js');
-
-function f(v)
-{
-  if (v + "")
-    ({} = v);
-}
-
-f(true);
-f({});
-assertThrowsInstanceOf(() => f(null), TypeError);
-assertThrowsInstanceOf(() => f(undefined), TypeError);
-
-function g(v)
-{
-  if (v + "")
-    ({} = v);
-}
-
-g(true);
-g({});
-assertThrowsInstanceOf(() => g(undefined), TypeError);
-assertThrowsInstanceOf(() => g(null), TypeError);
-
-function h(v)
-{
-  if (v + "")
-    ([] = v);
-}
-
-h([true]);
-h("foo");
-assertThrowsInstanceOf(() => h(undefined), TypeError);
-assertThrowsInstanceOf(() => h(null), TypeError);
-

js/src/jit-test/tests/basic/expression-autopsy.js

@@ -111,31 +111,12 @@ check("o[- (o)]");
 // A few one off tests
 check_one("6", (function () { 6() }), " is not a function");
 check_one("0", (function () { Array.prototype.reverse.call('123'); }), " is read-only");
+check_one(`(intermediate value)[Symbol.iterator](...).next(...).value`,
+          function () { var [{ x }] = [null, {}]; }, " is null");
+check_one(`(intermediate value)[Symbol.iterator](...).next(...).value`,
+          function () { ieval("let (x) { var [a, b, [c0, c1]] = [x, x, x]; }") }, " is undefined");
 check_one("void 1", function() { (void 1)(); }, " is not a function");
 check_one("void o[1]", function() { var o = []; (void o[1])() }, " is not a function");
 
-// Manual testing for a few isolated cases.  In these instances, the only way
-// to trigger an error is *not* on an attempted property access during
-// destructuring, but during a preceding ToObject() call on the value to be
-// iterated.  And the error message for failed ToObject(...) is different:
-// "can't convert {0} to object".
-function checkCantConvert(f, valstr)
-{
-    try
-    {
-        f();
-        throw new Error("didn't throw");
-    }
-    catch (e)
-    {
-        assertEq(e instanceof TypeError, true,
-                 "expected TypeError, got " + e + " for function " + f);
-        assertEq(e.message, "can't convert " + valstr + " to object");
-    }
-}
-
-checkCantConvert(function() { var [{x}] = [null, {}]; }, "null");
-checkCantConvert(function () { ieval("let (x) { var [a, b, [c0, c1]] = [x, x, x]; }") }, "undefined");
-
 // Check fallback behavior
 assertThrowsInstanceOf(function () { for (let x of undefined) {} }, TypeError);

js/src/jit-test/tests/for-of/for-of-primitive-with-iterator-hooked.js

@@ -1,32 +0,0 @@
-// Test that looking up a supposedly-iterable value's @@iterator property
-// first boxes up the value into an object via ToObject, then gets the
-// @@iterator using the object as receiver.  Cover only the for-of case: other
-// cases are handled elsewhere in the revision that introduced this test.
-"use strict";
-
-load(libdir + 'asserts.js');
-load(libdir + 'iteration.js');
-
-Object.defineProperty(Boolean.prototype, Symbol.iterator,
-{
-  get() {
-    assertEq(typeof this, "object",
-             "GetMethod(obj, @@iterator) internally first performs ToObject");
-    assertEq(this !== null, true,
-             "this is really an object, not null");
-
-    function FakeBooleanIterator()
-    {
-      assertEq(typeof this, "boolean",
-               "iterator creation code must perform ToObject(false) before " +
-               "doing a lookup for @@iterator");
-      return { next() { return { done: true }; } };
-    }
-
-    return FakeBooleanIterator;
-  },
-  configurable: true
-});
-
-for (var i of false)
-  assertEq(true, false, "not reached");

js/src/tests/ecma_6/Generators/delegating-yield-getiterator-does-toobject.js

@@ -1,58 +0,0 @@
-// With yield*, the GetIterator call on the provided value looks up the
-// @@iterator property on ToObject(value), not on a possibly-primitive value.
-"use strict";
-
-Object.defineProperty(Boolean.prototype, Symbol.iterator,
-{
-  get() {
-    assertEq(typeof this, "object",
-             "GetMethod(obj, @@iterator) internally first performs ToObject");
-    assertEq(this !== null, true,
-             "this is really an object, not null");
-
-    function FakeBooleanIterator()
-    {
-      assertEq(typeof this, "boolean",
-               "iterator creation code must perform ToObject(false) before " +
-               "doing a lookup for @@iterator");
-
-      var count = 0;
-      return { next() {
-                 if (count++ > 0)
-                   throw new Error("unexpectedly called twice");
-                 return { done: true };
-               } };
-
-    }
-
-    return FakeBooleanIterator;
-  },
-  configurable: true
-});
-
-function* f()
-{
-  yield 1;
-  yield* false;
-  yield 2;
-}
-
-for (var i = 0; i < 10; i++)
-{
-  var gen = f();
-
-  var first = gen.next();
-  assertEq(first.done, false);
-  assertEq(first.value, 1);
-
-  var second = gen.next();
-  assertEq(second.done, false);
-  assertEq(second.value, 2);
-
-  var last = gen.next();
-  assertEq(last.done, true);
-  assertEq(last.value, undefined);
-}
-
-if (typeof reportCompare === "function")
-  reportCompare(true, true);

js/src/tests/js1_8/regress/regress-469625-03.js

@@ -26,8 +26,8 @@ function test()
     var [a, b, [c0, c1]] = [x, x, x];
   }
 
-  expect = "TypeError: can't convert null to object";
-  actual = "No Error";
+  expect = `TypeError: (intermediate value)[Symbol.iterator](...).next(...).value is null`;
+  actual = 'No Error';
   try
   {
     f(null);

js/src/tests/js1_8_5/extensions/decompile-for-of.js

@@ -9,7 +9,7 @@ function check(code) {
         s = exc.message;
     }
 
-    assertEq(s, "(intermediate value)(...)[Symbol.iterator] is not a function");
+    assertEq(s, `x[Symbol.iterator] is not a function`);
 }
 
 x = {};

js/src/tests/js1_8_5/regress/regress-592202-1.js

@@ -2,14 +2,6 @@
  * Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/licenses/publicdomain/
  */
-i = 42;
-eval("let (y) { \n" +
-     "  (function() { \n" +
-     "    let ({} = (y, {})) { \n" +
-     "      (function() { \n" +
-     "         let ({} = y = []) (i); \n" +
-     "       })(); \n" +
-     "    } \n" +
-     "   })(); \n" +
-     "}");
+i = 42
+eval("let(y){(function(){let({}=y){(function(){let({}=y=[])(i)})()}})()}")
 reportCompare(0, 0, "ok");

js/src/vm/CommonPropertyNames.h

@@ -201,7 +201,6 @@
     macro(toISOString, toISOString, "toISOString") \
     macro(toJSON, toJSON, "toJSON") \
     macro(toLocaleString, toLocaleString, "toLocaleString") \
-    macro(ToObject, ToObject, "ToObject") \
     macro(toSource, toSource, "toSource") \
     macro(toString, toString, "toString") \
     macro(toUTCString, toUTCString, "toUTCString") \

js/src/vm/Interpreter.cpp

@@ -206,6 +206,7 @@ NoSuchMethod(JSContext* cx, unsigned argc, Value* vp)
         return false;
 
     MOZ_ASSERT(vp[0].isObject());
+    MOZ_ASSERT(vp[1].isObject());
     NativeObject* obj = &vp[0].toObject().as<NativeObject>();
     MOZ_ASSERT(obj->getClass() == &js_NoSuchMethodClass);