Fix handling of bogus receivers for Harmony collections.

test/mjsunit/harmony/collections.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 256 matching lines @@
 assertEquals(undefined, o.set);
 var o = Object.create({}, { myValue: {
   value: 10,
   enumerable: false,
   configurable: true,
   writable: true
 }});
 assertEquals(10, o.myValue);
 
 
+// Regression test for issue 1884: Invoking any of the methods for Harmony
+// maps, sets, or weak maps, with a wrong type of receiver should be throwing
+// a proper TypeError.
+function TestBogusReceivers(func) {
+  assertThrows(function () { func.call(undefined, {}) }, TypeError);
+  assertThrows(function () { func.call(null, {}) }, TypeError);
+  assertThrows(function () { func.call(true, {}) }, TypeError);
+  assertThrows(function () { func.call("x", {}) }, TypeError);
+  assertThrows(function () { func.call(23, {}) }, TypeError);
+  assertThrows(function () { func.call({}, {}) }, TypeError);

[rossberg, 2012/01/04 10:07:00]

Particularly interesting cases would be variations of:

Map.prototype.get(WeakMap(), {})

etc. (which is what actually triggered this bug report).

[Michael Starzinger, 2012/01/05 10:40:09]

Done. I generalized the regression test a bit.

+}
+TestBogusReceivers(Set.prototype.add);
+TestBogusReceivers(Set.prototype.has);
+TestBogusReceivers(Set.prototype.delete);
+TestBogusReceivers(Map.prototype.get);
+TestBogusReceivers(Map.prototype.set);
+TestBogusReceivers(Map.prototype.has);
+TestBogusReceivers(Map.prototype.delete);
+TestBogusReceivers(WeakMap.prototype.get);
+TestBogusReceivers(WeakMap.prototype.set);
+TestBogusReceivers(WeakMap.prototype.has);
+TestBogusReceivers(WeakMap.prototype.delete);
+
+
 // Stress Test
 // There is a proposed stress-test available at the es-discuss mailing list
 // which cannot be reasonably automated.  Check it out by hand if you like:
 // https://mail.mozilla.org/pipermail/es-discuss/2011-May/014096.html