[Webkit-unassigned] [Bug 205848] New: implementation of the class "extends" clause incorrectly uses __proto__ for setting prototypes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=205848

            Bug ID: 205848
           Summary: implementation of the class "extends" clause
                    incorrectly uses __proto__ for setting prototypes
           Product: WebKit
           Version: Safari Technology Preview
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: claude.pache at gmail.com

Control case:

    Object.defineProperty(Object.prototype, '__proto__', {
        configurable: true
      , set(x) { Reflect.setPrototypeOf(this, x); }
    })
    class A extends Array { }
    Reflect.getPrototypeOf(A) === Array // true
    Reflect.getPrototypeOf(A.prototype) === Array.prototype // true
    "push" in (new A) // true

Things become weird as soon as someone is removing Object.prototype.__proto__:

    delete Object.prototype.__proto__
    class B extends Array { }
    Reflect.getPrototypeOf(B) === Array // false
    Reflect.getOwnPropertyDescriptor(B, '__proto__').value === Array // true
    Reflect.getPrototypeOf(B.prototype) === Array.prototype // false
    "push" in (new B) // false

Or, said more clearly:

    Object.defineProperty(Object.prototype, '__proto__', {
        configurable: true
      , set(x) { throw new EvalError("Your code is bitrotten!"); }
    })
    class C extends Array { } // EvalError: Your code is bitrotten!

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200107/4bc60894/attachment.htm>