Open Bug 1257349 Opened 5 years ago

Don't mutate the [[Prototype]] when creating bound functions from Function subclass instances


(Core :: JavaScript Engine, defect)

Not set



Tracking Status
firefox48 --- affected


(Reporter: till, Unassigned)



Bound functions are created in self-hosted code, but some finishing touches happen in an intrinsic. Among those is ascertaining that the function has the right [[Prototype]]. That's almost always the case by default: both the target and the bound function are Function instances and have Function.prototype as their [[Prototype]].

Except when they don't. Specifically, when the target has a different [[Prototype]], which happens for instances of Function subclasses. Those are truly weird beasts anyway and somewhat unlikely to be used much, so I punted on them and just used SetPrototype. However, at some point some framework will enter the stage and use this for something that happens thousands of times per frame, so at some point we should fix this.

We could do so by creating a new JSFunction instance with the same script and environment, but a different [[Prototype]]. I think. I didn't try it, but don't see why it wouldn't work.
You need to log in before you can comment on or make changes to this bug.