1151149 - Proxy() constructor should throw when either target or handler are revoked proxies

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[Caitlin Potter [:caitp]]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2356.0 Safari/537.36

Steps to reproduce:

var r = Proxy.revocable({}, {});
var p = r.proxy;
r.revoke();
new Proxy(p, {});
new Proxy({}, p);

$log("We didn't throw!");

(Runnable example: http://jsfiddle.net/w6xyoy3j/)


Actual results:

We logged "We didn't throw!", indicating that these operations completed successfully.

When run in the dev console, [object Object] is printed --- indicating that touching the resulting object for printing threw, but actually constructing the object did not throw.


Expected results:

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-proxycreate says to throw if either the target or handler is a revoked proxy

Comment 1

[Tooru Fujisawa [:arai]]

Attachment: Throw if either the target or handler is a revoked proxy in Proxy constructor.

Implemented simple cases.

Do we need to handle following case too? (it's not caught by step 2 in this patch)
  var p = new Proxy(newGlobal().eval("var r = Proxy.revocable({}, {}); var p = r.proxy; r.revoke(); p;"), {});

https://treeherder.mozilla.org/#/jobs?repo=try&revision=a4f6edb9cb61

Comment 2

[Caitlin Potter [:caitp]]

It seems to me that a promise revoked in realm A should still be revoked in realm B, so on those grounds I think it does matter. Might be mistaken about that, though

Comment 3

[Tooru Fujisawa [:arai]]

Comment on attachment 8588447 [details] [diff] [review]
Throw if either the target or handler is a revoked proxy in Proxy constructor.

Thanks, I'll post fixed patch after it passed try run
https://treeherder.mozilla.org/#/jobs?repo=try&revision=6008a7cc90bf

Comment 4

[Tooru Fujisawa [:arai]]

Attachment: Throw if either the target or handler is a revoked proxy in Proxy constructor.

Last try fails with DOM proxy as target argument, so I used IsScriptedProxy to test the existence of target object only on scripted proxy.

Now green on try run: https://treeherder.mozilla.org/#/jobs?repo=try&revision=bbea4c67210a

Comment 5

[Eric Faust [:efaust]]

Comment on attachment 8588553 [details] [diff] [review]
Throw if either the target or handler is a revoked proxy in Proxy constructor.

Review of attachment 8588553 [details] [diff] [review]:
-----------------------------------------------------------------

Looks right to me. Security concerns are also a valid reason to throw, as noted. Thanks for updating the step comments as well.

Comment 6

[Tooru Fujisawa [:arai]]

Thank you for reviewing :D

https://hg.mozilla.org/integration/mozilla-inbound/rev/17a40c12a007

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/17a40c12a007