@@toStringTag spoofing for null and undefined

Boris Zbarsky bzbarsky at mit.edu
Tue Jan 20 12:21:28 PST 2015

On 1/20/15 3:13 PM, Jordan Harband wrote:
> Between the two issues I proposed, I definitely think that "something
> pretending to be a builtin" is far less hazardous then "altering
> builtins to appear to be something else". If removing the prefixing
> entirely is what it takes to make *all* (not just ES5) builtin
> @@toStringTag values non-configurable, I'd be happy with that.

I don't see how that solves the problem you're trying to solve.


   var arr = [];
   Object.defineProperty(arr, Symbol.toStringTag,
                         { value: "Date" });

In today's spec, Object.prototype.toString.call(arr) will be "[object 

If the ~-prefixing is removed, this will return "[object Date]", no? 
The fact that @@toStringTag is non-configurable on Array.prototype 
doesn't matter, since the above code shadows it on the instance.


More information about the es-discuss mailing list