<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [JSC] Private symbols should not be trapped by proxy handler"
href="https://bugs.webkit.org/show_bug.cgi?id=154817">154817</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[JSC] Private symbols should not be trapped by proxy handler
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>utatane.tea@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Since the runtime has some assumptions on the properties bound with private symbols, ES6 Proxy should not trap these property operations.
For example, in ArrayIteratorPrototype.js
var itemKind = this.@arrayIterationKind;
if (itemKind === @undefined)
throw new @TypeError("%ArrayIteratorPrototype%.next requires that |this| be an Array Iterator instance");
Here, we assume that only the array iterator has @arrayIterationKind property that value is non-undefined.
But If we implement Proxy with the get handler, that returns non-undefined value for every operations, we accidentally assumes that the given value is an array iterator.
To avoid these situation, we perform the default operations onto property ops with private symbols.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>