Bug 239797
| Summary: | %ThrowTypeError% is defined more than once per realm | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Richard Gibson <richard.gibson> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | ashvayka, mark.lam, saam, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Richard Gibson
This is a JavaScriptCore analog of SpiderMonkey https://bugzilla.mozilla.org/show_bug.cgi?id=1484547
https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-addrestrictedfunctionproperties and https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-createunmappedargumentsobject specify that the getter and setter for each of `Function.prototype` "caller", `Function.prototype` "arguments", and strict-mode function body `arguments` "callee" should all be the same %ThrowTypeError% built-in function. However, JavaScriptCore returns a distinct value for all but the getter/setter pair for strict-mode `arguments` "callee":
```js
(function(){
"use strict";
const inputs = [
["Function.prototype `caller` getter", Object.getOwnPropertyDescriptor(Function.prototype, "caller").get],
["Function.prototype `caller` setter", Object.getOwnPropertyDescriptor(Function.prototype, "caller").set],
["Function.prototype `arguments` getter", Object.getOwnPropertyDescriptor(Function.prototype, "arguments").get],
["Function.prototype `arguments` setter", Object.getOwnPropertyDescriptor(Function.prototype, "arguments").set],
["arguments `callee` getter", Object.getOwnPropertyDescriptor(arguments, "callee").get],
["arguments `callee` setter", Object.getOwnPropertyDescriptor(arguments, "callee").set],
];
const groups = new Map();
for (let [label, fn] of new Map(inputs)) {
const group = groups.get(fn) || groups.set(fn, []).get(fn);
group.push(label);
}
return JSON.stringify([...groups.values()], null, 2);
})()
/* =>
[
[
"Function.prototype `caller` getter"
],
[
"Function.prototype `caller` setter"
],
[
"Function.prototype `arguments` getter"
],
[
"Function.prototype `arguments` setter"
],
[
"arguments `callee` getter",
"arguments `callee` setter"
]
]
*/
```
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Yusuke Suzuki
Nice catch!
Radar WebKit Bug Importer
<rdar://problem/92704818>
Yusuke Suzuki
"arguments `callee` getter" and "arguments `callee` setter" should have the same %ThrowTypeError%, but for the other cases, we are currently following to https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md
Richard Gibson
Are you saying that you conform with a Stage 1 proposal rather than the published specification? If so, why?
Alexey Shvayka
(In reply to Richard Gibson from comment #4)
> Are you saying that you conform with a Stage 1 proposal rather than the
> published specification? If so, why?
Yes, we implement the Stage 1 proposal almost in full (except for cross-realm leakage which we still allow).
I've determined two benefits in aligning with SM and moving accessors to Function.prototype:
* that greatly simplified our JSFunction overrides;
* a userland function with own non-configurable properties was problematic to use as [[ProxyTarget]].