unknownPrivateSymbol trap (was: WeakMap better than Private Symbols? (was: direct_proxies "problem"))

Tom Van Cutsem tomvc.be at gmail.com
Thu Jan 17 02:51:53 PST 2013


Ok, thanks for your clarifying example.

I see your point. Basically you want obj[privateSymbol] to be a
high-integrity operation that proxies cannot even abort (unless they know
about the private symbol). That would give
private-symbol-keyed-property-access a special status, since other
important operations like Object.isFrozen(obj) can also be aborted by
proxies.

It's important to reiterate that the proxy can only make the code fail
noisily. It can't hide that it's being evil. In that sense it does not
violate the integrity of the abstraction.

That said, I welcome suggestions to get rid of this trap.

Re. your suggestion for a primitive that inadvertently cuts all access to a
proxy's target. That already exists via revocable proxies:

let {proxy, revoke } = Proxy.revocable(target, handler);
revoke(); // proxy nulls out its target, it can't forward anything anymore
(including private symbols it doesn't know about)

See <http://wiki.ecmascript.org/doku.php?id=strawman:revokable_proxies>

However, I'm not yet sure how a membrane could make use of revocable
proxies efficiently. In the simplest membrane code, all proxies of the same
membrane share a single boolean flag that controls whether all of these
proxies are active or revoked. Setting the flag to false instantly revokes
all proxies at once.

If all proxies of a membrane are revocable, the membrane would need to
store all of their revoke() functions in a collection and call them all
when the membrane as a whole is revoked. That feels way more expensive.
Then again, I think this might be needed anyway if we want to ensure that a
revoked membrane releases all pointers to its enclosed object graph, so
that those objects can be GC-ed...

Cheers,
Tom

2013/1/16 Nathan Wall <nathan.wall at live.com>

> > set(key, value) {
> >
> >     let data = this[$data];
> >
> >     if (!data)
> >         throw new TypeError('this object must be a StringMap');
> >
> >     if (!(key in data))
> >         this[$size]++;
> >
> >     data[key] = value;
> >
> > }
>
>
> Doh! I wrote that in such a way that an inconsistency cannot be
> introduced, since `$data` is retrieved before `$size` is changed, and then
> the mutation on the data object happens without the use of a private symbol.
>
> However, I think you get the idea.
>
> Probably a better example would have been one where I wanted to mutate two
> private symbol properties with primitive values, in which case they would
> both require calls to `unknownPrivateSymbol` when being set.
>
> Nathan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20130117/7132e192/attachment-0001.html>


More information about the es-discuss mailing list