archives

« Bugzilla Issues Index

#2014 — 9.3.1 [[GetPrototypeOf]]: Missing type check for trap result


9.3.1 [[GetPrototypeOf]] ( ), step 10:

The trapResult needs to be validated to be either an Object or null, otherwise the general [[GetPrototypeOf]] contract is violated (returns only Object or null).


> 10. If extensibleTarget is true, then return trapResult.

=>

10. If extensibleTarget is true, then
a. If Type(handlerProto) is neither Object nor Null, then throw a TypeError exception.
b. Return handlerProto.


Maybe the type check should actually be applied directly after step 7, similar to 9.3.5 [[GetOwnProperty]], step 9.


More basically, 'trapResult' is referenced by step 10, but not defined anywhere in the algorithm. The change suggested above appears to assume that it's a typo for 'handlerProto'.


fixed in rev20 editor's draft


fixed in rev20 draft, Oct. 28, 2013