test262 icon indicating copy to clipboard operation
test262 copied to clipboard

Temporal: Add coverage for int32-string calendar field names

Open anba opened this issue 2 years ago • 0 comments

This test case crashes in both V8 and SpiderMonkey (with the patches from https://bugzilla.mozilla.org/show_bug.cgi?id=1519167 applied):

let calendar = new class extends Temporal.Calendar {
  fields(names) {
    return ["20", ...super.fields(names), "10"];
  }
}("iso8601");

let date = new Temporal.PlainDate(2000, 1, 1, calendar).with({year: 2001});
console.log(date.toString());

It'd be good to have coverage for this case in test262, because int32 string property keys are special cased in all engines.

V8

# Fatal error in ../../src/objects/lookup-inl.h, line 108                                                                                                                                                                            
# Debug check failed: !name_->AsIntegerIndex(&integer_index).

#0  0x00007ffff7fb2503 in v8::base::OS::Abort() () at ../../src/base/platform/platform-posix.cc:690
#1  0x00007ffff7f94b42 in V8_Fatal(char const*, int, char const*, ...) () at ../../src/base/logging.cc:167
#2  0x00007ffff7f945d5 in v8::base::(anonymous namespace)::DefaultDcheckHandler(char const*, int, char const*) () at ../../src/base/logging.cc:57
#3  0x00007ffff5c92af6 in v8::internal::LookupIterator::LookupIterator(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>, unsigned long, v8::internal::Handle<v8::internal::Object>, v8::internal::LookupIterator::Configuration) () at ../../src/objects/lookup-inl.h:105
#4  0x00007ffff697afef in v8::internal::(anonymous namespace)::PrepareTemporalFieldsOrPartial(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::Handle<v8::internal::FixedArray>, v8::internal::(anonymous namespace)::RequiredFields, bool) () at ../../src/objects/lookup-inl.h:34
#5  0x00007ffff691fd5c in v8::internal::JSTemporalPlainDate::With(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSTemporalPlainDate>, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>) () at ../../src/objects/js-temporal-objects.cc:2140
#6  0x00007ffff5ecbf1a in v8::internal::Builtin_Impl_TemporalPlainDatePrototypeWith(v8::internal::BuiltinArguments, v8::internal::Isolate*) () at ../../src/builtins/builtins-temporal.cc:246
#7  0x00007ffff5ecb934 in v8::internal::Builtin_TemporalPlainDatePrototypeWith(int, unsigned long*, v8::internal::Isolate*) () at ../../src/builtins/builtins-temporal.cc:246
...

SpiderMonkey

Assertion failure: IsSorted(fieldNames), at /home/andre/hg/mozilla-central/js/src/builtin/temporal/TemporalFields.cpp:517

#0  js::temporal::PrepareTemporalFields(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::StackGCVector<JS::PropertyKey, js::TempAllocPolicy> >) (cx=cx@entry=0x7ffff7637600, fields=fields@entry=(JSObject * const) 0xe5c02b00938 [object Temporal.PlainDate], fieldNames=fieldNames@entry=...) at /home/andre/hg/mozilla-central/js/src/builtin/temporal/TemporalFields.cpp:517
#1  0x000055555805bcd0 in PlainDate_with(JSContext*, JS::CallArgs const&) (cx=cx@entry=0x7ffff7637600, args=...) at /home/andre/hg/mozilla-central/js/src/builtin/temporal/PlainDate.cpp:2050
...

@FrankYFTang

anba avatar Jun 12 '23 15:06 anba