Bug 161111 – toString called on proxies returns incorrect tag

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Alexey Shvayka]

When `Object.prototype.toString` is called on proxy objects with target that has no `@@toStringTag` defined,
it returns `ProxyObject` instead of correct tag:

```js
toString.call(new Proxy(new Map, {})) // [object Map], correct
toString.call(new Proxy(Math, {})) // [object Math], correct
toString.call(new Proxy({ [Symbol.toStringTag]: "Hello" }, {})) // [object Hello], correct

toString.call(new Proxy(new String, {})) // [object ProxyObject], incorrect
// should report [object Object], because proxy is not String exotic object

toString.call(new Proxy(/(?:)/, {})) // [object ProxyObject], incorrect
// should report [object Object], because proxy object does not have [[RegExpMatcher]]

toString.call(new Proxy([], {})) // [object ProxyObject], incorrect
// should report [object Array], because isArray when called on proxy, checks
// its target for arrayness (internal methods)

toString.call(new Proxy(() => {}, {})) // [object ProxyObject], incorrect
// should report [object Function], because toString checks for [[Call]] and
// Proxy constructor creates [[Call]] on proxy if it is present on target

toString.call(new Proxy({}, {})) // [object ProxyObject], incorrect
// should report [object Object]
```

[Keith Miller]

Interesting, this happens because the className for Proxies is ProxyObject rather than Object. Joe, does the WebInspector use the className of Proxy objects for inspectoring?

[Joseph Pecoraro]

(In reply to comment #1)
> Interesting, this happens because the className for Proxies is ProxyObject
> rather than Object. Joe, does the WebInspector use the className of Proxy
> objects for inspectoring?

No, Web Inspector doesn't rely on it for anything.

Currently, Web Inspector just internally checks if an object is a ProxyObject in JSInjectedScriptHost so that we can add internal properties [[Target]], [[Handler]].

It just so happens that we expose ProxyObject when logging an object that is a proxy:

  > new Proxy({}, {})
  < ProxyObject {target: {}, handler: {}}

but again, we don't rely on that. We could easily denote proxies in some explicit way.

[Keith Miller]

Created attachment 287037 [details]
Patch

[Keith Miller]

Created attachment 287041 [details]
Patch

[Joseph Pecoraro]

Comment on attachment 287041 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=287041&action=review

Looks good to me!

> Source/JavaScriptCore/ChangeLog:11
> +        In future patchs I plan to make it work for other classes of objects as

Typo: "patchs" => "patches"

[Keith Miller]

Committed r205023: <http://trac.webkit.org/changeset/205023>

[Alexey Shvayka]

I am testing in r205172, everything works per spec except for `toString` called on proxy with function target: `ProxyCreate` (https://tc39.github.io/ecma262/#sec-proxycreate) checks for `[[Call]]` on target (step 7a) and sets the method on proxy object if it exists. `toString` (https://tc39.github.io/ecma262/#sec-object.prototype.tostring) checks for `[[Call]]` in step 8 and should return `"[object Function]"` unless `@@toStringTag` is specified. Test cases:

```js
toString.call(new Proxy(() => {}, {})) // should return [object Function], not [object Object]
toString.call(new Proxy(function () {}, {})) // should return [object Function], not [object Object]
toString.call(new Proxy(function*() {}, {})) // [object GeneratorFunction], correct
```

[Alexey Shvayka]

(In reply to Alexey Shvayka from comment #7)
> I am testing in r205172, everything works per spec except for `toString`
> called on proxy with function target...

Remaining test cases were fixed in r261159.