Bug 918341 - new Map(iterable) should check that iterator values are objects. r=jorendorff

js/src/builtin/MapObject.cpp

@@ -1163,9 +1163,12 @@ MapObject::construct(JSContext *cx, unsigned argc, Value *vp)
                 return false;
             if (done)
                 break;
-            // FIXME: We're supposed to throw if pairVal isn't an object.  Bug
-            // 918341.
-            pairObj = ToObject(cx, pairVal);
+            if (!pairVal.isObject()) {
+                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INVALID_MAP_ITERABLE);
+                return false;
+            }
+
+            pairObj = &pairVal.toObject();
             if (!pairObj)
                 return false;
 

js/src/jit-test/tests/collections/Map-constructor-5.js

@@ -5,3 +5,11 @@ assertThrowsInstanceOf(function () { Map([undefined]); }, TypeError);
 assertThrowsInstanceOf(function () { Map([null]); }, TypeError);
 assertThrowsInstanceOf(function () { Map([[0, 0], [1, 1], , [3, 3]]); }, TypeError);
 assertThrowsInstanceOf(function () { Map([[0, 0], [1, 1], ,]); }, TypeError);
+
+// Map(iterable) throws if iterable doesn't have array-like objects
+
+assertThrowsInstanceOf(function () { Map([1, 2, 3]); }, TypeError);
+assertThrowsInstanceOf(function () {
+	let s = new Set([1, 2, "abc"]);
+	new Map(s);
+}, TypeError);

js/src/js.msg

@@ -222,7 +222,7 @@ MSG_DEF(JSMSG_CANT_SEAL_OBJECT,       168, 1, JSEXN_ERR, "can't seal {0} objects
 MSG_DEF(JSMSG_TOO_MANY_CATCH_VARS,    169, 0, JSEXN_SYNTAXERR, "too many catch variables")
 MSG_DEF(JSMSG_NEGATIVE_REPETITION_COUNT, 170, 0, JSEXN_RANGEERR, "repeat count must be non-negative")
 MSG_DEF(JSMSG_INVALID_FOR_OF_INIT,    171, 0, JSEXN_SYNTAXERR, "for-of loop variable declaration may not have an initializer")
-MSG_DEF(JSMSG_UNUSED172,              172, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_INVALID_MAP_ITERABLE,   172, 0, JSEXN_TYPEERR, "iterable for map should have array-like objects")
 MSG_DEF(JSMSG_UNUSED173,              173, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_UNUSED174,              174, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_NESTING_GENERATOR,      175, 0, JSEXN_TYPEERR, "already executing generator")