On __proto__ as a magical data property

Jason Orendorff jason.orendorff at gmail.com
Wed Jul 18 15:19:28 PDT 2012

On Wed, Jul 18, 2012 at 3:31 PM, Brendan Eich <brendan at mozilla.org> wrote:
> In particular, we don't want a proto-chain walk from [[CanPut]] and a second
> walk from the "has" under the __proto__ setter for
>   obj.__proto__ = safe; // not in SES code
> just because we might need the "has" for
>   evil = Object.getOwnPropertyDescriptor(Object.prototype, '__proto__').set;
>   // later ...
>   evil.call(victim, unsafe);
> How would you spec this?

I would spec the desired semantics.  I really don't think we should
bend the language spec an iota around performance here.

But it certainly could be optimized.  The extra lookup can be
optimized away with a PIC, or the lookup could be fused with the proto
chain cycle check.  Making it possible for objects share a shape after
setting __proto__ is the low-hanging fruit here though.  Last I
looked, changing an object's __proto__ was very deoptimizing in


More information about the es-discuss mailing list