Function.prototype.apply length-computation behavior observably applies ToNumber twice

Jeff Walden jwalden+es at MIT.EDU
Fri Jul 16 10:47:53 PDT 2010


var called = false;
var argArray =
   { length: { valueOf: function() { if (called) throw 17; called = true; return 12; } } };

(function(){}).apply({}, argArray); // should throw 17


Was it intentional for Function.prototype.apply to invoke ToNumber twice (once via ToUint32) on the length property of argArray?  I don't especially care, but it does seem rather odd for that to be the case.  It appears to be easily fixable if desired, just change these steps:

6. Let n be ToUint32(len).
7. If n is not equal to ToNumber(len), then throw a TypeError exception.

...to these steps:

6. Let n be ToNumber(len).
7. If n is not equal to ToUint32(n), then throw a TypeError exception.
7.5. Let n be ToUint32(n).

Jeff


More information about the es5-discuss mailing list