Must built-in prototypes also be valid instances? (Was: Why DataView.prototype object's [[Class]] is "Object"?)
brendan at mozilla.com
Mon Oct 1 12:39:49 PDT 2012
Allen Wirfs-Brock wrote:
> Line 5.c.v is dealing with the ES5 requirement that "host objects" not
> reuse the listed [[Class]] values for anything other than the
> specified built-ins. This version of toStrimg extends the spirit to
> that restriction to all user or implementation defined tag values. It
> does this by prepending a "~" in front of those values if they appear
> as a tag value. Note that ES5.1 includes "Object" in this list so I
> also included it. But, I actually think it probably should be in the
> censored list.
This is weird.
ES5 wanted to help SES and similar languages use some kind of
and not be subject to spoofing.
Adding @@toStringTag to enable DOM self-hosting runs directly counter to
Prefixing "~" to core-language built-in classes (save "Object"?) does
not resolve the conflict if there are spoofing hazards in other
built-ins such as DOM objects as typically implemented in browsers.
Mark, can you weigh in? I had not heard of this "~"-prefixing idea.
More information about the es-discuss