Bug 239797 – %ThrowTypeError% is defined more than once per realm

• Status: NEW
• Component: JavaScriptCore

[Richard Gibson]

This is a JavaScriptCore analog of SpiderMonkey https://bugzilla.mozilla.org/show_bug.cgi?id=1484547

https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-addrestrictedfunctionproperties and https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-createunmappedargumentsobject specify that the getter and setter for each of `Function.prototype` "caller", `Function.prototype` "arguments", and strict-mode function body `arguments` "callee" should all be the same %ThrowTypeError% built-in function. However, JavaScriptCore returns a distinct value for all but the getter/setter pair for strict-mode `arguments` "callee":

```js
(function(){
  "use strict";
  const inputs = [
    ["Function.prototype `caller` getter", Object.getOwnPropertyDescriptor(Function.prototype, "caller").get],
    ["Function.prototype `caller` setter", Object.getOwnPropertyDescriptor(Function.prototype, "caller").set],
    ["Function.prototype `arguments` getter", Object.getOwnPropertyDescriptor(Function.prototype, "arguments").get],
    ["Function.prototype `arguments` setter", Object.getOwnPropertyDescriptor(Function.prototype, "arguments").set],
    ["arguments `callee` getter", Object.getOwnPropertyDescriptor(arguments, "callee").get],
    ["arguments `callee` setter", Object.getOwnPropertyDescriptor(arguments, "callee").set],
  ];
  const groups = new Map();
  for (let [label, fn] of new Map(inputs)) {
    const group = groups.get(fn) || groups.set(fn, []).get(fn);
    group.push(label);
  }
  return JSON.stringify([...groups.values()], null, 2);
})()
/* =>
[
  [
    "Function.prototype `caller` getter"
  ],
  [
    "Function.prototype `caller` setter"
  ],
  [
    "Function.prototype `arguments` getter"
  ],
  [
    "Function.prototype `arguments` setter"
  ],
  [
    "arguments `callee` getter",
    "arguments `callee` setter"
  ]
]
*/
```

[Yusuke Suzuki]

Nice catch!

[Radar WebKit Bug Importer]

<rdar://problem/92704818>

[Yusuke Suzuki]

"arguments `callee` getter" and "arguments `callee` setter" should have the same %ThrowTypeError%, but for the other cases, we are currently following to https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md

[Richard Gibson]

Are you saying that you conform with a Stage 1 proposal rather than the published specification? If so, why?

[Alexey Shvayka]

(In reply to Richard Gibson from comment #4)
> Are you saying that you conform with a Stage 1 proposal rather than the
> published specification? If so, why?

Yes, we implement the Stage 1 proposal almost in full (except for cross-realm leakage which we still allow).

I've determined two benefits in aligning with SM and moving accessors to Function.prototype:
  * that greatly simplified our JSFunction overrides;
  * a userland function with own non-configurable properties was problematic to use as [[ProxyTarget]].