Bug 125307 – DOM objects violate fundamental ES6 invariants

• Component: JavaScriptCore
• Status: RESOLVED CONFIGURATION CHANGED

[Boris Zbarsky]

Given this markup:

  <div>TEXT</div>

this script:

  function serializeDescriptor(desc) {
    var str = "{ ";
    for (var prop in desc) {
      str += prop + ": " + desc[prop] + "; "
    }
    return str + "}"
  }
  var div = document.querySelector("div");
  document.writeln("firstChild descriptor: " +
                   serializeDescriptor(Object.getOwnPropertyDescriptor(div, "firstChild")));

outputs:

  firstChild descriptor: { value: [object Text]; writable: false; enumerable: true; configurable: false; }

In ES6 section 6.1.7.3 (Invariants of the Essential Internal Methods) says:

  The [[GetOwnProperty]] internal method of all objects must conform to the following invariants
  for each property of the object:
...
    If a property is described as a data property and its [[Writable]] and [[Configurable]] are
    both false, then the SameValue (according to 7.2.3) must be returned for the [[Value]]
    attribute of the property on all calls to [[GetOwnProperty]].

However simply running div.removeChild(div.firstChild) makes the object's [[GetOwnProperty]] return a descriptor with a different [[Value]].

[Anne van Kesteren]

All of this has been revised quite a bit. I think there might still be some invariant violations left, but those are open specification issues.