derived from https://mail.mozilla.org/pipermail/es-discuss/2012-June/023343.html
According to the ECMA262 5.1th, [[Call]] of host object may return Reference Type.
So, all values using raw [[Call]] result may be Reference Type.
For example, [[Get]] may return Reference Type if getter is a host object that [[Call]] returns Reference Type.
http://ecma-international.org/ecma-262/5.1/#sec-8.12.3
As the result, GetValue may return Reference Type because that use result value of [[Get]]
http://ecma-international.org/ecma-262/5.1/#sec-8.7.1
And, for example, if we define getter of object, getter function is host object that [[Call]] return Reference Type,
(10, obj.getter)
returns Reference type, so,
(10, obj.getter) = 10;
is valid because GetValue is performed, but GetValue result is also Reference Type.
In the ECMA262 5.1th, GetValue is assumed that doesn't return Reference Type, for exmaple,
var obj = {
get v() {
// this v function is host object and returns Reference;
// we can define this v using host object and defineProperty
return Reference;
}
};
And,
typeof obj.v
Then, typeof should treat Reference Type also, but in 11.4.3, Reference Type is not considered.
http://ecma-international.org/ecma-262/5.1/#sec-11.4.3
I think this is a bug of spec and GetValue and [[Get]] should not return Reference type, is it right?
To fix this, I think following 3 ways are good.
1. perform GetValue on [[Call]] result in the spec
2. re-define [[Get]] and GetValue can return Reference Type. This needs to re-define all the spec part using [[Get]], GetValue and others
3. remove feature that [[Call]] can return Reference Type
Because all modern engines don't consider that [[Call]] result is Reference and this feature makes big performance-regression, personally I think 3 is better.
[[Call]] can no longer return a Reference.
Fixed in rev 15 draft