Bug 6601 – valueOf confuses JSC when run through KDE shouldThrow test

• Component: JavaScriptCore
• Status: RESOLVED INVALID

[Geoffrey Garen]

The attached reduction.html fails in Safari but passes in Firefox. This line:

testPassed(_a + " threw exception " + exception + ".");

ends up throwing an exception somehow.

Using the function name "valueOf" in the test code is the key to triggering this bug.

[Geoffrey Garen]

Created attachment 5729 [details]
Reduction.

[Cameron Zwarich (cpst)]

This doesn't pass in either Firefox or Opera, for the same reason as WebKit. Are you sure this is a bug?

[Gavin Barraclough]

This test case is invalid, and correctly fails (it fails in firefox, too).

The problem is that the test adds a valueOf method to the Object prototype.  The test (that an error is thrown) then passes (an error is thrown when Date.prototype.valueOf is applied to a vanilla object).

The test harness then tries to format up an error message indicating the test passed, using the following line:
    testPassed(_a + " threw exception " + exception + ".");
This will call ToPrimitive with the numeric hint on exception, which will favor calling the valueOf operator on the object.  Since TypeError derive from object, and the object prototype still has the date prototypes valueOf, the ToPrimitive conversion will correctly throw an error.