__proto__ security

[Allen Wirfs-Brock]

Let's try to get this back to concrete issues that I can incorporate into a specification.

The current draft is at http://wiki.ecmascript.org/lib/exe/fetch.php?id=strawman%3Amagic_proto_property&cache=cache&media=harmony:draft_proto_spec_rev2.pdf 

Gavin and Oliver seem to really want to use an accessor for  Object.prototype.__proto__

Brendan has expressed a willingness to accepting under specify some the Object.prototype.__proto__ property in ways that we normally wouldn't for mandatory parts of the specification.  

I could accommodate these two perspective by changing the first paragraph of the draft B.3.1.1 to read:

The __proto__ property of the Object prototype property initially has the attributes {[[Enumerable]]: false, [[Configurable]]: true}.  The state of other attributes and whether it is an accessor or data property is implementation defined.

This would allow implementations to use either a data property or a access property for Object.prototype.__proto__.  However, the internal method extensions are still needed in order to define the semantics in a manner that allows either implementation approach to be used.

Finally, an alternative to extending [[Get]] and [[Put]] would be to extend the GetValue abstraction operation (8.7.1) and the Simple Assignment evaluation semantics (11.13.1).

[[DefineOwnProperty]] and [[Delete]] still need to be extended but, independent of any of the above, these two can probably be made over-riding implementations on Object.prototype rather than extending the default implementations used by all objects.

 Allen


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20120213/233b4feb/attachment.html>