According to [ES6 6.7.1.3] Invariants of the Essential Internal Methods: If a property P is described as a data property with Desc.[[Value]] equal to v and Desc.[[Writable]] and Desc.[[Configurable]] are both false, then the SameValue must be returned for the Desc.[[Value]] attribute of the property on all future calls to [[GetOwnProperty]] ( P ). [ES6 6.7.1.3]: http://www.ecma-international.org/ecma-262/6.0/#sec-invariants-of-the-essential-internal-methods Testcase against `Function#arguments` ```js function f() { return Object.getOwnPropertyDescriptor(f, 'arguments'); } Object.getOwnPropertyDescriptor(f, 'arguments'); // value: null, writable: false, configurable: false f(); // value: Arguments[], writable: false, configurable: false ``` Testcase against `Function#caller` ```js function g() { return Object.getOwnPropertyDescriptor(g, 'caller'); } function h() { return g(); } Object.getOwnPropertyDescriptor(g, 'caller'); // value: null, writable: false, configurable: false h(); // value: function h(), writable: false, configurable: false ``` Suggested fix: Use getters. Similar bug: Bug 151348
I've observed this bug within a non directly related code: ``` (function() { 'use strict'; class Foo {} const a = new Proxy(function() {}, { ownKeys() { return Reflect.ownKeys(Foo) } }); console.log(Object.getOwnPropertySymbols(a)); })(); // strict mode, ok (function() { 'use sloppy'; class Foo {} const a = new Proxy(function() {}, { ownKeys() { return Reflect.ownKeys(Foo) } }); console.log(Object.getOwnPropertySymbols(a)); })(); ``` The code in sloppy mode breaks in Chrome and Safari because the function object will have non-configurable own properties arguments and caller and the Proxy trap is required to list all non-configurable properties from the Proxy target.
Ping. What is the status of this?
Created attachment 430793 [details] Patch
(In reply to Alexey Shvayka from comment #3) > Created attachment 430793 [details] > Patch r278563 patch reflect-own-keys-function 45.4040+-0.8465 ^ 21.7507+-0.2064 ^ definitely 2.0875x faster function-prototype-get 39.7061+-0.9041 ^ 35.6181+-0.3754 ^ definitely 1.1148x faster <geometric> 42.4357+-0.6210 ^ 27.8294+-0.1872 ^ definitely 1.5248x faster
Created attachment 430875 [details] Patch Adjust LayoutTests.
Created attachment 432853 [details] Patch Adjust put-to-proto-chain-overrides-put.js stress test.
Comment on attachment 432853 [details] Patch r=me
Comment on attachment 432853 [details] Patch I appreciate the review!
Committed r280289 (239947@main): <https://commits.webkit.org/239947@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 432853 [details].
<rdar://problem/81083194>