Closed Bug 201987 Opened 22 years ago Closed 22 years ago

delete "".x throws ClassCastException

Categories

(Rhino Graveyard :: Core, defect)

defect
Not set
normal

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: igor, Assigned: norrisboyd)

Details

Attachments

(1 file)

The following code when executed produces unexpected exception instead of expected Ok printout: var test = delete "".x print (test ? "OK" : "FAILED");
Confirming on WinNT: -------------------- Rhino 1.5 release 5 0000 00 00 -------------------- js> delete "".x Exception in thread "main" java.lang.ClassCastException at org.mozilla.javascript.ScriptRuntime.delete(ScriptRuntime.java:1064) at org.mozilla.javascript.Interpreter.interpret(Interpreter.java:2019) at org.mozilla.javascript.InterpretedScript.call(InterpretedScript.java:62) at org.mozilla.javascript.InterpretedScript.exec(InterpretedScript.java:55) at org.mozilla.javascript.Context.evaluateReader(Context.java:806) at org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:363) at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:260) at org.mozilla.javascript.tools.shell.Main.exec(Main.java:103) at org.mozilla.javascript.tools.shell.Main.main(Main.java:76) ----------------------- COMPARE SPIDERMONKEY ----------------------- js> delete "".x true Note: this may seem confusing at first, since |""| doesn't have any property named |x|. Here is an ECMA-262 Edition 3 reference: 11.4.1 The delete Operator The production UnaryExpression : delete UnaryExpression is evaluated as follows: 1. Evaluate UnaryExpression. 2. If Type(Result(1)) is not Reference, return true. 3. Call GetBase(Result(1)). 4. Call GetPropertyName(Result(1)). 5. Call the [[Delete]] method on Result(3), providing Result(4) as the property name to delete. 6. Return Result(5). I believe that even though |"".x| hasn't been defined, it is still of type "Reference" in the technical language of the ECMA spec. So we pass Step 2 of 11.4.1 and make it to Step 5. This relies on the internal [[Delete]] method on objects, specified by: 8.6.2.5 [[Delete]] (P) When the [[Delete]] method of O is called with property name P, the following steps are taken: 1. If O doesn’t have a property with name P, return true. 2. If the property has the DontDelete attribute, return false. 3. Remove the property with name P from O. 4. Return true. Therefore by Step 1 here, since |""| doesn't have a property named |x|, the return value of |delete "".x| should be |true|.
Testcase added to JS testsuite: mozilla/js/tests/ecma_3/Operators/11.4.1-001.js Currently passing in SpiderMonkey, crashing in Rhino as above -
The patch touches Interpreter.java and optimizer/Codegen.java since it changes ScriptRuntime.delete to pass Contex and scope for toObject call.
I commited the above patch.
Status: NEW → RESOLVED
Closed: 22 years ago
Resolution: --- → FIXED
Verified FIXED. The above testcase now passes in the Rhino shell in compiled and interpreted mode.
Status: RESOLVED → VERIFIED
Targeting as resolved against 1.5R5
Target Milestone: --- → 1.5R5
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: