333728 - |typeof (0, undef)| does not throw ReferenceError

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Andreas]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040914 (not Googlebot)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040914 (not Googlebot)

:

Reproducible: Always

Steps to Reproduce:
Assuming |undef| doesn't exist and |this| isn't null:

typeof (0, undef)
typeof (0 || undef)
typeof (1 && undef)
typeof (0 ? 0 : undef)
typeof (1 ? undef : 0)
typeof (!this ? 0 : undef)

Actual Results:  
evaluate all to the string "undefined"


Expected Results:  
should all throw ReferenceError, because ECMA specifies a GetValue() on |undef|
before |typeof| becomes involved.


Note that |typeof (this ? undef : 0)| has correct behaviour, but
|typeof (1 ? undef : 0)| is erronously optimized to |typeof (undef)|
(same bytecode), which doesn't call GetValue().

The code seems to be located here:
http://lxr.mozilla.org/mozilla/source/js/src/jsinterp.c#3965

Comment 1

[Philip Withnall (unavailable)]

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9a1) Gecko/20060413 Firefox/3.0a1 - Build ID: 0000000000
Confirmed.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix, v1

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 220065 [details] [diff] [review]
Fix, v1

Thanks, now to resolve the conflict this will cause my generators patch in jsopcode.tbl! :-P

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Exceptions/regress-333728.js

I'll check this into the tree when it opens again.

Is this test correct or is the fix incomplete? In todays Minefield build on winxp I get:

BUGNUMBER: 333728
STATUS: Throw ReferenceErrors for typeof(...undef)
FAILED!: Throw ReferenceErrors for typeof(...undef): typeof (0 ? 0 : undef)
FAILED!: Expected value 'ReferenceError', Actual value 'undefined'
FAILED!:
FAILED!: Throw ReferenceErrors for typeof(...undef): typeof (1 ? undef : 0)
FAILED!: Expected value 'ReferenceError', Actual value 'undefined'
FAILED!:

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

I think you might be getting bitten by constant folding. When I try this in the shell, I see:
js> function f() { return typeof(1 ? undef : 1); }
js> dis(f)
main:
00000:  name "undef"
00003:  group
00004:  typeof
00005:  return
00006:  stop

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in regress-333728.js;
/cvsroot/mozilla/js/tests/js1_5/Exceptions/regress-333728.js,v  <--  regress-333728.js
initial revision: 1.1

verified fixed 20060520

Comment 8

[Bob Clary [:bc] (inactive)]

fixed by Bug 336373 on the 1.8.1 branch. 
verified fixed 1.8.1 with windows/macppc/linux 20060707