In "4.2.22. Nullable types -- T?",
in the IDL->ECMAscript conversion,
the second bullet says:

    Otherwise, the ECMAScript value is the result of converting the
    IDL nullable type value to the inner IDL type T.

which incorrectly implies that you can get an ECMAScript value when you convert
an IDL value to an IDL type.

I think you need to change:
    to the inner IDL type T
to:
    using the rules for the inner IDL type T

Or perhaps change the whole bullet to something like:

    Otherwise, the IDL value must be a value of the nullable type's
    inner type T. The ECMAScript value is the result of converting
    the IDL value using the rules for T.