Closed Bug 1216661 Opened 9 years ago Closed 8 years ago

Object.prototype.toString should throw when called with revoked proxy

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1114580
Tracking Flags:
Tracking Status
firefox44 --- affected

People

(Reporter: anba, Unassigned)

References

(Blocks 1 open bug)

Details

Test case:
---
var {proxy,revoke}=Proxy.revocable({},{});
revoke();
Object.prototype.toString.call(proxy);
---

Expected: Throws TypeError
Actual: Returns "[object Object]"


See ScriptedDirectProxyHandler::className()
> // Right now the caller is not prepared to handle failures.

https://dxr.mozilla.org/mozilla-central/rev/9605da94e75d61598d3c00f01a12d1b6bc427a6c/js/src/proxy/ScriptedDirectProxyHandler.cpp#1127
Implementing ES6 toString semantics would fix this.  A conceptually smaller, but possibly more difficult/tedious/laborious, fix would be to make className() fallible.
After landing bug 1114580 this will start throwing by virtue of the @@toStringTag lookup on the proxy throwing.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.