jscript: Throw TypeError in in_eval.

dlls/jscript/engine.c

@@ -2065,10 +2065,8 @@ static HRESULT in_eval(exec_ctx_t *ctx, VARIANT *lval, VARIANT *obj, jsexcept_t
     BSTR str;
     HRESULT hres;
 
-    if(V_VT(obj) != VT_DISPATCH) {
-        FIXME("throw TypeError\n");
-        return E_FAIL;
-    }
+    if(V_VT(obj) != VT_DISPATCH || !V_DISPATCH(obj))
+        return throw_type_error(ctx->parser->script, ei, IDS_OBJECT_EXPECTED, NULL);
 
     hres = to_string(ctx->parser->script, lval, ei, &str);
     if(FAILED(hres))

dlls/jscript/tests/api.js

@@ -1891,6 +1891,9 @@ exception_test(function() {encodeURI('\udcaa');}, "URIError", -2146823264);
 exception_test(function() {(new Object()) instanceof 3;}, "TypeError", -2146823286);
 exception_test(function() {(new Object()) instanceof null;}, "TypeError", -2146823286);
 exception_test(function() {(new Object()) instanceof nullDisp;}, "TypeError", -2146823286);
+exception_test(function() {"test" in 3;}, "TypeError", -2146823281);
+exception_test(function() {"test" in null;}, "TypeError", -2146823281);
+exception_test(function() {"test" in nullDisp;}, "TypeError", -2146823281);
 
 function testThisExcept(func, number) {
     exception_test(function() {func.call(new Object())}, "TypeError", number);