Function identity of non-configurable accessors

David Bruant bruant.d at
Sat Dec 15 06:27:56 PST 2012


ES5 invariants are silent when it comes to function identity of 
non-configurable accessors. That is, for a given object o,
     Object.getOwnPropertyDescriptor(o, 'a').get === 
Object.getOwnPropertyDescriptor(o, 'a').get
(two seperate calls) is not guaranteed.

The built-in [[DefineOwnProperty]] (ES5.1 - 8.12.9) prevents from 
changing of getter and setter functions when the property is not 
configurable (step 11), but that's not an expected invariant for 
self-hosted objects.

I think that the current definition of non-compatible descriptors (based 
on Object.getOwnPropertyDescriptor and Object.defineProperty) used in 
invariant checks makes impossible to use different functions and that 
may be a problem.

The way things are going, WindowProxy [Unforgeable] properties will be 
non-configurable getters. If, upon underlying window change, the 
WindowProxy is expected to keep the exact same getter function, then, it 
may result in capability leaks (attach something in a getter in one 
iframe and get it back when the iframe at src has changed). One solution 
could be to make these getters frozen; a better solution would be to not 
"same getter identity" as an invariant for proxies reflecting 
non-configurable accessors.


More information about the es-discuss mailing list