Closed
Bug 201987
Opened 22 years ago
Closed 22 years ago
delete "".x throws ClassCastException
Categories
(Rhino Graveyard :: Core, defect)
Rhino Graveyard
Core
Tracking
(Not tracked)
VERIFIED
FIXED
1.5R5
People
(Reporter: igor, Assigned: norrisboyd)
Details
Attachments
(1 file)
The following code when executed produces unexpected exception instead of
expected Ok printout:
var test = delete "".x
print (test ? "OK" : "FAILED");
Comment 1•22 years ago
|
||
Confirming on WinNT:
-------------------- Rhino 1.5 release 5 0000 00 00 --------------------
js> delete "".x
Exception in thread "main" java.lang.ClassCastException
at org.mozilla.javascript.ScriptRuntime.delete(ScriptRuntime.java:1064)
at org.mozilla.javascript.Interpreter.interpret(Interpreter.java:2019)
at org.mozilla.javascript.InterpretedScript.call(InterpretedScript.java:62)
at org.mozilla.javascript.InterpretedScript.exec(InterpretedScript.java:55)
at org.mozilla.javascript.Context.evaluateReader(Context.java:806)
at org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:363)
at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:260)
at org.mozilla.javascript.tools.shell.Main.exec(Main.java:103)
at org.mozilla.javascript.tools.shell.Main.main(Main.java:76)
----------------------- COMPARE SPIDERMONKEY -----------------------
js> delete "".x
true
Note: this may seem confusing at first, since |""| doesn't have any
property named |x|. Here is an ECMA-262 Edition 3 reference:
11.4.1 The delete Operator
The production UnaryExpression : delete UnaryExpression is evaluated as follows:
1. Evaluate UnaryExpression.
2. If Type(Result(1)) is not Reference, return true.
3. Call GetBase(Result(1)).
4. Call GetPropertyName(Result(1)).
5. Call the [[Delete]] method on Result(3), providing Result(4)
as the property name to delete.
6. Return Result(5).
I believe that even though |"".x| hasn't been defined, it is still
of type "Reference" in the technical language of the ECMA spec. So
we pass Step 2 of 11.4.1 and make it to Step 5. This relies on the
internal [[Delete]] method on objects, specified by:
8.6.2.5 [[Delete]] (P)
When the [[Delete]] method of O is called with property name P,
the following steps are taken:
1. If O doesn’t have a property with name P, return true.
2. If the property has the DontDelete attribute, return false.
3. Remove the property with name P from O.
4. Return true.
Therefore by Step 1 here, since |""| doesn't have a property named |x|,
the return value of |delete "".x| should be |true|.
Comment 2•22 years ago
|
||
Testcase added to JS testsuite:
mozilla/js/tests/ecma_3/Operators/11.4.1-001.js
Currently passing in SpiderMonkey, crashing in Rhino as above -
Reporter | ||
Comment 3•22 years ago
|
||
The patch touches Interpreter.java and optimizer/Codegen.java since it changes
ScriptRuntime.delete to pass Contex and scope for toObject call.
Reporter | ||
Comment 4•22 years ago
|
||
I commited the above patch.
Status: NEW → RESOLVED
Closed: 22 years ago
Resolution: --- → FIXED
Comment 5•22 years ago
|
||
Verified FIXED.
The above testcase now passes in the Rhino shell in compiled and interpreted mode.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•