Possible Loophole (was: Proposal: Property fixing)

Tom Van Cutsem tomvc.be at gmail.com
Mon Jun 20 01:56:47 PDT 2011


2011/6/20 Tom Van Cutsem <tomvc.be at gmail.com>

> The updated strawman is already more akin to your proposed second
> implementation. The way I currently think about a Proxy's
> [[DefineOwnProperty]] method with support for fixed properties is as
> follows:
>
> [[DefineOwnProperty]] (P, Desc, Throw)
> 1. Let handler be the value of the [[Handler]] internal property of O.
> 2. Let defineProperty be the result of calling the [[Get]] internal method
> of handler with argument “defineProperty”.
> 3. If defineProperty is undefined, throw a TypeError exception.
> 4. If IsCallable(defineProperty) is false, throw a TypeError exception.
> 5. Let trapResult be the result of calling the [[Call]] internal method of
> defineProperty providing handler as the this value, P as the first argument
> and Desc as the second argument.
> 6. If ToBoolean(trapResult) is false, reject.
> 7. Let desc be ToPropertyDescriptor(trapResult)
> 8. If [[GetOwnProperty]](P) is not undefined, or desc.[[Configurable]] is
> false
>   a. return [[DefineOwnProperty]](P, desc, Throw) (as per ES5 8.12.9)
> 9. return true
>

Bugfix: we can't just let the handler reject if P already denotes a fixed
property:

[[DefineOwnProperty]] (P, Desc, Throw)
1. Let handler be the value of the [[Handler]] internal property of O.
2. Let defineProperty be the result of calling the [[Get]] internal method
of handler with argument “defineProperty”.
3. If defineProperty is undefined, throw a TypeError exception.
4. If IsCallable(defineProperty) is false, throw a TypeError exception.
5. Let trapResult be the result of calling the [[Call]] internal method of
defineProperty providing handler as the this value, P as the first argument
and Desc as the second argument.
6. Let fixedProperty be the result of calling Object.[[GetOwnProperty]](P)
7. If ToBoolean(trapResult) is false,
  a. If fixedProperty is undefined, reject.
  b. Otherwise, fixedProperty is defined, so throw a TypeError.
8. Let desc be ToPropertyDescriptor(trapResult)
9. If fixedProperty is not undefined, or desc.[[Configurable]] is false
  a. Return Object.[[DefineOwnProperty]](P, desc, Throw)
10. Return true

Clarification: Object.[[GetOwnProperty]] and Object.[[DefineOwnProperty]]
refer to the algorithms for Object values from ES5 sections 8.12.1 and
8.12.9 respectively. They are used to manipulate a proxy's set of fixed
properties, which are all non-configurable (since the only way they end up
in that record is by virtue of the second condition in line 9)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20110620/2b66e842/attachment.html>


More information about the es-discuss mailing list