Object.prototype.toString should throw when called with revoked proxy

RESOLVED DUPLICATE of bug 1114580

Status

()

defect
RESOLVED DUPLICATE of bug 1114580
4 years ago
3 years ago

People

(Reporter: anba, Unassigned)

Tracking

(Blocks 1 bug)

Trunk
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox44 affected)

Details

Reporter

Description

4 years ago
Test case:
---
var {proxy,revoke}=Proxy.revocable({},{});
revoke();
Object.prototype.toString.call(proxy);
---

Expected: Throws TypeError
Actual: Returns "[object Object]"


See ScriptedDirectProxyHandler::className()
> // Right now the caller is not prepared to handle failures.

https://dxr.mozilla.org/mozilla-central/rev/9605da94e75d61598d3c00f01a12d1b6bc427a6c/js/src/proxy/ScriptedDirectProxyHandler.cpp#1127
Implementing ES6 toString semantics would fix this.  A conceptually smaller, but possibly more difficult/tedious/laborious, fix would be to make className() fallible.
After landing bug 1114580 this will start throwing by virtue of the @@toStringTag lookup on the proxy throwing.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1114580
You need to log in before you can comment on or make changes to this bug.