Bug 1660965 - Report bad JS::Value contents in crash messages r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D88117

js/public/Value.h

@@ -1273,6 +1273,9 @@ class HeapBase<JS::Value, Wrapper>
   }
 };
 
+MOZ_HAVE_NORETURN MOZ_COLD MOZ_NEVER_INLINE void ReportBadValueTypeAndCrash(
+    const JS::Value& val);
+
 // If the Value is a GC pointer type, call |f| with the pointer cast to that
 // type and return the result wrapped in a Maybe, otherwise return None().
 template <typename F>
@@ -1314,7 +1317,7 @@ auto MapGCThingTyped(const JS::Value& val, F&& f) {
     }
   }
 
-  MOZ_CRASH("no missing return");
+  ReportBadValueTypeAndCrash(val);
 }
 
 // If the Value is a GC pointer type, call |f| with the pointer cast to that

js/src/gc/GC.cpp

@@ -8283,19 +8283,19 @@ JS::GCCellPtr::GCCellPtr(const Value& v) : ptr(0) {
   switch (v.type()) {
     case ValueType::String:
       ptr = checkedCast(v.toString(), JS::TraceKind::String);
-      break;
+      return;
     case ValueType::Object:
       ptr = checkedCast(&v.toObject(), JS::TraceKind::Object);
-      break;
+      return;
     case ValueType::Symbol:
       ptr = checkedCast(v.toSymbol(), JS::TraceKind::Symbol);
-      break;
+      return;
     case ValueType::BigInt:
       ptr = checkedCast(v.toBigInt(), JS::TraceKind::BigInt);
-      break;
+      return;
     case ValueType::PrivateGCThing:
       ptr = checkedCast(v.toGCThing(), v.toGCThing()->getTraceKind());
-      break;
+      return;
     case ValueType::Double:
     case ValueType::Int32:
     case ValueType::Boolean:
@@ -8304,9 +8304,11 @@ JS::GCCellPtr::GCCellPtr(const Value& v) : ptr(0) {
     case ValueType::Magic: {
       MOZ_ASSERT(!v.isGCThing());
       ptr = checkedCast(nullptr, JS::TraceKind::Null);
-      break;
+      return;
     }
   }
+
+  ReportBadValueTypeAndCrash(v);
 }
 
 JS::TraceKind JS::GCCellPtr::outOfLineKind() const {

js/src/vm/Interpreter.cpp

@@ -970,7 +970,7 @@ JSType js::TypeOfValue(const Value& v) {
       break;
   }
 
-  MOZ_CRASH("unexpected type");
+  ReportBadValueTypeAndCrash(v);
 }
 
 bool js::CheckClassHeritageOperation(JSContext* cx, HandleValue heritage) {

js/src/vm/Value.cpp

@@ -6,6 +6,10 @@
 
 #include "js/Value.h"
 
+#include "mozilla/Assertions.h"
+
+#include <inttypes.h>
+
 static const JS::Value JSVAL_NULL =
     JS::Value::fromTagAndPayload(JSVAL_TAG_NULL, 0);
 static const JS::Value JSVAL_FALSE =
@@ -30,3 +34,8 @@ const Handle<mozilla::Maybe<Value>> NothingHandleValue =
     Handle<mozilla::Maybe<Value>>::fromMarkedLocation(&JSVAL_NOTHING);
 
 }  // namespace JS
+
+void js::ReportBadValueTypeAndCrash(const JS::Value& value) {
+  MOZ_CRASH_UNSAFE_PRINTF("JS::Value has illegal type: 0x%" PRIx64,
+                          value.asRawBits());
+}