647831 - TypeError thrown in [[DefaultValue]] if "valueOf" property is neither callable nor primitive

Status: RESOLVED DUPLICATE of bug 645468

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0

[[DefaultValue]] with hint "Number" first tries to get the "valueOf" property and tests whether the property is callable through IsCallable(). If the "valueOf" property is not callable, the algorithm falls back to use "toString". (And tests callable for "ToString" etc.). See 8.12.8 [[DefaultValue]]
The fallback part doesn't seem to work if the "valueOf" property is not a primitive value and also not callable (e.g. an Object or an Array). In that case a TypeError is thrown, although the "toString" property should be used instead.

Reproducible: Always

Steps to Reproduce:
Execute the following expressions
1) "" + {valueOf: void 0, toString: function (){ return "toString" }}
2) "" + {valueOf: null, toString: function (){ return "toString" }}
3) "" + {valueOf: 0, toString: function (){ return "toString" }}
4) "" + {valueOf: false, toString: function (){ return "toString" }}
5) "" + {valueOf: "", toString: function (){ return "toString" }}
6) "" + {valueOf: {}, toString: function (){ return "toString" }}
7) "" + {valueOf: [], toString: function (){ return "toString" }}
8) "" + {valueOf: /(?:)/, toString: function (){ return "toString" }}
9) "" + {valueOf: /(?:foo)/, toString: function (){ return "toString" }}
10) "" + {valueOf: new Date(), toString: function (){ return "toString" }}
Actual Results:  
1) "toString"
2) "toString"
3) "toString"
4) "toString"
5) "toString"
6) TypeError thrown
7) TypeError thrown
8) "toString"
9) "null"
10) TypeError thrown

Note for 9: any 'complex' RegExp seems to produce "null", 'complex' = anything else than the empty RegExp /(?:)/

Expected Results:  
1) "toString"
2) "toString"
3) "toString"
4) "toString"
5) "toString"
6) "toString"
7) "toString"
8) "toString"
9) "toString"
10) "toString"

Works as expected in IE9 and Safari 5.0.4
Similar problems are present in Opera 11.01

Comment 1

[André Bargull [:anba]]

This is a ES5 compatibility issue, Firefox 4 still seems to follow the
[[DefaultValue]] algorithm specified in ES3

Comment 2

[Tom S [:evilpie]]

js_TryMethod really is the wrong answer.

Comment 3

[André Bargull [:anba]]

> Note for 9: any 'complex' RegExp seems to produce "null", 'complex' = anything else than the empty RegExp /(?:)/

@myself -> RegExp is callable in Firefox

Comment 4

[Tom S [:evilpie]]

Not anymore btw.