Must built-in prototypes also be valid instances? (Was: Why DataView.prototype object's [[Class]] is "Object"?)

Brendan Eich brendan at
Mon Oct 1 12:39:49 PDT 2012

Allen Wirfs-Brock wrote:
> Line 5.c.v is dealing with the ES5 requirement that "host objects" not 
> reuse the listed [[Class]] values for anything other than the 
> specified built-ins. This version of toStrimg extends the spirit to 
> that restriction to all user or implementation defined tag values.  It 
> does this by prepending a "~" in front of those values if they appear 
> as a tag value.  Note that ES5.1 includes "Object" in this list so I 
> also included it. But, I actually think it probably should be in the 
> censored list.

This is weird.

ES5 wanted to help SES and similar languages use some kind of


and not be subject to spoofing.

Adding @@toStringTag to enable DOM self-hosting runs directly counter to 
this goal.

Prefixing "~" to core-language built-in classes (save "Object"?) does 
not resolve the conflict if there are spoofing hazards in other 
built-ins such as DOM objects as typically implemented in browsers.

Mark, can you weigh in? I had not heard of this "~"-prefixing idea.


More information about the es-discuss mailing list