1800062 - Object with `Symbol.toPrimitive` property being used as property access key of undefined

Status: UNCONFIRMED

(Core :: JavaScript Engine, defect, P3)

Description

[f52985]

Steps to reproduce:

Execute the following program using jsshell

undefined [ { [ Symbol.toPrimitive ] : () => { REF_ERR; } } ] ;

Actual results:

TypeError: undefined has no properties
is thrown

Expected results:

ReferenceError: REF_ERR is not defined
should be thrown.

According to the ECMA-262 Specification, the EvaluatePropertyAccessWithExpressionKey algorithm calls the algorithm ToPropertyKey at step 3, which eventually calls the method [Symbol . toPrimitive] and throws reference error. This should happen before checking if the base object is undefined or not.