333730 - null object in for-in does not throw TypeError

Status: RESOLVED DUPLICATE of bug 292731

(Core :: JavaScript Engine, defect)

Description

[Andreas]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040914 (not Googlebot)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040914 (not Googlebot)

:

Reproducible: Always

Steps to Reproduce:
1. Evaluate: for ( var prop in null ) ;

Actual Results:  
Nothing.


Expected Results:  
Should throw TypeError because ECMA requires an ToObject() operation on the
RHS of "in", which is specified as "Throw a TypeError exeption" for types
Null and Undefined in section 9.9.


Code is at http://lxr.mozilla.org/mozilla/source/js/src/jsinterp.c#2322
(AFACT only used for for-in loops).

Can be fixed by replacing

                ok = js_ValueToObject(cx, rval, &obj);
                if (!ok)
                    goto out;

with

                obj = js_ValueToNonNullObject(cx, rval);
                if (!obj) {
                    ok = JS_FALSE;
                    goto out;
                }

in the JSOP_TOOBJECT case section, but may be a compatibility issue. I have no IE to test at hand, but my (outdated) Konqueror 3.3.1 has the same bug.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

We tried this and it unfortunately broke ChatZilla (and presumably other JavaScript code). Fixing this bug, while making us more compliant with the spec, will break backwards compatibility that apps rely on.

*** This bug has been marked as a duplicate of 292731 ***

Comment 2

[Andreas]

This should be in the ECMA 262-3 errata if all major implementations don't
throw TypeError.

The actual implementation of the first algorithm in 12.6.4 is

1. Let V = empty.
2. Evaluate the Expression.
3. Call GetValue(Result(2)).
4. If Result(3) is undefined or null, go to step 15.
5. Call ToObject(Result(3)).
...
15. Return (normal, V, empty).

instead of

1. Evaluate the Expression.
2. Call GetValue(Result(1)).
3. Call ToObject(Result(2)).
4. Let V = empty.
...
14. Return (normal, V, empty).

Similar for the second algorithm.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Brendan, Bob, who owns the errata?

Comment 4

[Bob Clary [:bc] (inactive)]

(In reply to comment #3)
> Brendan, Bob, who owns the errata?
>
I assume I do. It should move to devmo with much of the other js docs.
http://www.mozilla.org/js/language/E262-3-errata.html