Open Bug 1800062 Opened 2 years ago Updated 2 years ago

Object with `Symbol.toPrimitive` property being used as property access key of undefined

Categories

(Core :: JavaScript Engine, defect, P3)

Firefox 107
defect

Tracking

()

UNCONFIRMED

People

(Reporter: f52985, Unassigned)

References

(Blocks 1 open bug, )

Details

Steps to reproduce:

Execute the following program using jsshell

undefined [ { [ Symbol.toPrimitive ] : () => { REF_ERR; } } ] ;

Actual results:

TypeError: undefined has no properties
is thrown

Expected results:

ReferenceError: REF_ERR is not defined
should be thrown.

According to the ECMA-262 Specification, the EvaluatePropertyAccessWithExpressionKey algorithm calls the algorithm ToPropertyKey at step 3, which eventually calls the method [Symbol . toPrimitive] and throws reference error. This should happen before checking if the base object is undefined or not.

Blocks: sm-runtime
Severity: -- → S3
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.