New issue
Advanced search Search tips
Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 4709
Owner:
Closed: Aug 16
Cc:
Components:
HW: ----
NextAction: ----
OS: ----
Priority: 2
Type: Bug



Sign in to add a comment

"name" property of Proxy revocation functions set incorrectly

Reported by timothygu99@gmail.com, Dec 26 2017

Issue description

Version: 6.5.107
OS: linux
Architecture: x86-64

What steps will reproduce the problem?

Object.getOwnPropertyDescriptor(Proxy.revocable({}, {}).revoke, 'name');

What is the expected output?

undefined

What do you see instead?

{value: "revoke", writable: false, enumerable: false, configurable: true}

Please use labels and text to provide additional information.

Per [1], Proxy revocation functions are anonymous functions, which should not have a "name" property in accordance with [2]. Other anonymous functions in V8 all do not have "name" properties:

- Promise resolve/reject functions
  new Promise((resolve, reject) => { print(resolve.name); print(reject.name); });

- GetCapabilitiesExecutor functions
  class PromiseSub extends Promise { constructor(executor) { print(executor.name); super(executor); } } PromiseSub.resolve();

- Promise.all resolve element functions
  class PromiseSub extends Promise { then(onResolve, onReject) { print(onResolve.name); super.then(onResolve, onReject); } } PromiseSu
b.all([PromiseSub.resolve()]);

- AsyncFunction awaited fulfilled/rejected functions
  (async () => { await { then(onFulfilled, onRejected) { print(onFulfilled.name); print(onRejected.name); } } })()

The cause for this bug seems to be https://cs.chromium.org/chromium/src/v8/src/js/proxy.js?l=23&rcl=f5b1d1d4f29b238ca2f0a13bf3a7b7067854592d, where the "name" property is unfortunately automatically added to the function by virtue of it being in an object literal. An indirect expression like "revoke: (0, () => %JSProxyRevoke(p))" would mitigate this behavior.

SpiderMonkey has the same bug as V8 (bug will be filed soon), but ChakraCore does not.

[1]: https://tc39.github.io/ecma262/#sec-proxy-revocation-functions
[2]: https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
 
See also issue 4709. Though this issue is somewhat different in that the "name" own property is not the empty string.
Components: Language
Labels: Priority-2
Status: Available (was: Untriaged)

Comment 3 by adamk@chromium.org, Jan 2 2018

Labels: SpecViolation-ReadyToFix
Project Member

Comment 4 by bugdroid1@chromium.org, Jan 7 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e

commit ddfbbc5537046d1dab880ba1fc0de10d43b1de4e
Author: Timothy Gu <timothygu99@gmail.com>
Date: Sun Jan 07 10:20:13 2018

[builtins] Port Proxy.revocable() to CSA

Bug:  v8:7245 
Change-Id: Ia8931037021b935e776230a6a50c580ad82efba8
Reviewed-on: https://chromium-review.googlesource.com/844065
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50394}
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/AUTHORS
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/BUILD.gn
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/bootstrapper.cc
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-definitions.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-promise-gen.cc
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-promise-gen.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-proxy-gen.cc
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-proxy-gen.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/code-stub-assembler.cc
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/code-stub-assembler.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/contexts.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/heap-symbols.h
[delete] https://crrev.com/211d569a2bfd0f5f18ca41d75325f1c72c9de9e6/src/js/proxy.js
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/objects.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/runtime/runtime-proxy.cc
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/runtime/runtime.h
[modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/v8.gyp
[add] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/test/mjsunit/regress/regress-v8-7245.js

Mergedinto: 4709
Owner: adamk@chromium.org
Status: Duplicate (was: Available)
The behavior is now more correct, in that the value of the property is now "", instead of "revoke". So this bug just becomes a dup of the broader issue that every V8 function has a "name" own property, contra spec.
Cc: timothygu@chromium.org

Sign in to add a comment