Security Demands Simplicity (was: Private Slots)

Tom Van Cutsem at
Mon Jan 21 08:21:06 PST 2013

2013/1/20 Kevin Smith <khs4473 at>

>  It is not. At the exit of the get trap, the JS engine checks whether
>> invariants should be enforced for the given property on the target. In your
>> case, the runtime sees that the target has a non-configurable non-writable
>> property called 'foo' with 1 as value. When you try to return 0, it will
>> throw a TypeError because of invariant violation. You can read about
>> invariants at
> Excellent - thanks for the link!

I wrote an introductory article a while back explaining precisely the
interaction between frozen objects and proxies, and the invariant checks.
Easier to digest than the draft spec on the wiki:

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the es-discuss mailing list