[[Get]] and GetValue can return Reference Type

[Yusuke Suzuki]

This issue is derived from Esprima issue 81
http://code.google.com/p/esprima/issues/detail?id=81

Hello everyone,

According to the ECMA262 5.1th, [[Call]] of host object may return
Reference Type.
So, all values using raw [[Call]] result may be Reference Type.

For example, [[Get]] may return Reference Type if *getter* is a host object
that [[Call]] returns Reference Type.
http://ecma-international.org/ecma-262/5.1/#sec-8.12.3
As the result, GetValue may return Reference Type because that use result
value of [[Get]]
http://ecma-international.org/ecma-262/5.1/#sec-8.7.1

And, for example, if we define getter of object, getter function is host
object that [[Call]] return Reference Type,

    (10, obj.getter)

returns Reference type, so,

    (10, obj.getter) = 10;

is valid because GetValue is performed, but GetValue result is also
Reference Type.

In the ECMA262 5.1th, GetValue is assumed that doesn't return Reference
Type, for exmaple,

    var obj = {
        get v() {
           // this v function is host object and returns Reference;
           // we can define this v using host object and defineProperty
           return Reference;
        }
    };

And,

    typeof obj.v

Then, typeof should treat Reference Type also, but in 11.4.3, Reference
Type is not considered.
http://ecma-international.org/ecma-262/5.1/#sec-11.4.3

I think this is a bug of spec and GetValue and [[Get]] should not return
Reference type, is it right?

To fix this, I think following 3 way are good.

   1. perform GetValue on [[Call]] result in the spec
   2. re-define [[Get]] and GetValue can return Reference Type. This needs
   to re-define all the spec part using [[Get]], GetValue and others
   3. remove feature that [[Call]] can return Reference Type

Because all modern engines don't consider that [[Call]] result is Reference
and this feature makes big performance-regression, personally I think 3 is
better.

Regards,
Yusuke Suzuki
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20120612/b8c527dc/attachment-0001.html>