Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions

[Aruna Herath]

Object.getOwnPropertyNames((() => {}).bind({}))

Returned array for above method call includes "arguments".

If the values in this array are accessed in the function a type error will be thrown.
Following code will throw.

const boundFn = (() => {}).bind({});
Object.getOwnPropertyNames(boundFn).forEach(p => {boundFn[p]});

In Chrome, firefox "arguments" is not there in the returned array.

[Yusuke Suzuki]

Basically, either having or not having is OK. This was originally derived from web compatibility extension. But if no browsers have this property right now, we can remove it I think.

[Yusuke Suzuki]

(In reply to Yusuke Suzuki from comment #1)
> Basically, either having or not having is OK. This was originally derived
> from web compatibility extension. But if no browsers have this property
> right now, we can remove it I think.

No. We should remove them.
https://tc39.github.io/ecma262/#sec-forbidden-extensions

ECMAScript function objects defined using syntactic constructors in strict mode code must not be created with own properties named "caller" or "arguments". Such own properties also must not be created for function objects defined using an ArrowFunction, MethodDefinition, GeneratorDeclaration, GeneratorExpression, ClassDeclaration, ClassExpression, AsyncFunctionDeclaration, AsyncFunctionExpression, or AsyncArrowFunction regardless of whether the definition is contained in strict mode code. Built-in functions, strict functions created using the Function constructor, generator functions created using the Generator constructor, async functions created using the AsyncFunction constructor, and functions created using the bind method also must not be created with such own properties.

[Yusuke Suzuki]

Created attachment 330642 [details]
Patch

[EWS Watchlist]

Attachment 330642 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/ChangeLog:8:  Line contains tab character.  [whitespace/tab] [5]
ERROR: Source/JavaScriptCore/ChangeLog:9:  Line contains tab character.  [whitespace/tab] [5]
ERROR: Source/JavaScriptCore/ChangeLog:11:  Line contains tab character.  [whitespace/tab] [5]
Total errors found: 3 in 4 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Yusuke Suzuki]

Created attachment 330643 [details]
Patch

[Saam Barati]

Comment on attachment 330643 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=330643&action=review

> Source/JavaScriptCore/runtime/JSBoundFunction.cpp:225
>      String name; // We lazily create our 'name' string property.

Does JSBoundFunction have its own Structure?

[Yusuke Suzuki]

Created attachment 330644 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 330643 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=330643&action=review

>> Source/JavaScriptCore/runtime/JSBoundFunction.cpp:225
>>      String name; // We lazily create our 'name' string property.
> 
> Does JSBoundFunction have its own Structure?

Yes, we have ones.

[EWS Watchlist]

Comment on attachment 330644 [details]
Patch

Attachment 330644 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/5957222

New failing tests:
inspector/runtime/getProperties.html
js/strict-throw-type-error.html
inspector/model/remote-object-get-properties.html

[EWS Watchlist]

Created attachment 330645 [details]
Archive of layout-test-results from ews102 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews102  Port: mac-elcapitan  Platform: Mac OS X 10.11.6

[Yusuke Suzuki]

Created attachment 330646 [details]
Patch

[Yusuke Suzuki]

Committed r226489: <https://trac.webkit.org/changeset/226489>

[Radar WebKit Bug Importer]

<rdar://problem/36336710>