Issue metadata
Sign in to add a comment
|
"name" property of Proxy revocation functions set incorrectly
Reported by
timothygu99@gmail.com,
Dec 26 2017
|
||||||||||||||||||||||||
Issue description
Version: 6.5.107
OS: linux
Architecture: x86-64
What steps will reproduce the problem?
Object.getOwnPropertyDescriptor(Proxy.revocable({}, {}).revoke, 'name');
What is the expected output?
undefined
What do you see instead?
{value: "revoke", writable: false, enumerable: false, configurable: true}
Please use labels and text to provide additional information.
Per [1], Proxy revocation functions are anonymous functions, which should not have a "name" property in accordance with [2]. Other anonymous functions in V8 all do not have "name" properties:
- Promise resolve/reject functions
new Promise((resolve, reject) => { print(resolve.name); print(reject.name); });
- GetCapabilitiesExecutor functions
class PromiseSub extends Promise { constructor(executor) { print(executor.name); super(executor); } } PromiseSub.resolve();
- Promise.all resolve element functions
class PromiseSub extends Promise { then(onResolve, onReject) { print(onResolve.name); super.then(onResolve, onReject); } } PromiseSu
b.all([PromiseSub.resolve()]);
- AsyncFunction awaited fulfilled/rejected functions
(async () => { await { then(onFulfilled, onRejected) { print(onFulfilled.name); print(onRejected.name); } } })()
The cause for this bug seems to be https://cs.chromium.org/chromium/src/v8/src/js/proxy.js?l=23&rcl=f5b1d1d4f29b238ca2f0a13bf3a7b7067854592d, where the "name" property is unfortunately automatically added to the function by virtue of it being in an object literal. An indirect expression like "revoke: (0, () => %JSProxyRevoke(p))" would mitigate this behavior.
SpiderMonkey has the same bug as V8 (bug will be filed soon), but ChakraCore does not.
[1]: https://tc39.github.io/ecma262/#sec-proxy-revocation-functions
[2]: https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
,
Jan 2 2018
,
Jan 2 2018
,
Jan 7 2018
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e commit ddfbbc5537046d1dab880ba1fc0de10d43b1de4e Author: Timothy Gu <timothygu99@gmail.com> Date: Sun Jan 07 10:20:13 2018 [builtins] Port Proxy.revocable() to CSA Bug: v8:7245 Change-Id: Ia8931037021b935e776230a6a50c580ad82efba8 Reviewed-on: https://chromium-review.googlesource.com/844065 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50394} [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/AUTHORS [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/BUILD.gn [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/bootstrapper.cc [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-definitions.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-promise-gen.cc [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-promise-gen.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-proxy-gen.cc [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/builtins/builtins-proxy-gen.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/code-stub-assembler.cc [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/code-stub-assembler.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/contexts.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/heap-symbols.h [delete] https://crrev.com/211d569a2bfd0f5f18ca41d75325f1c72c9de9e6/src/js/proxy.js [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/objects.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/runtime/runtime-proxy.cc [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/runtime/runtime.h [modify] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/src/v8.gyp [add] https://crrev.com/ddfbbc5537046d1dab880ba1fc0de10d43b1de4e/test/mjsunit/regress/regress-v8-7245.js
,
Aug 16
The behavior is now more correct, in that the value of the property is now "", instead of "revoke". So this bug just becomes a dup of the broader issue that every V8 function has a "name" own property, contra spec.
,
Aug 17
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by timothygu99@gmail.com
, Dec 27 2017