1484547 - %ThrowTypeError% intrinsic is defined more than once

Status: UNCONFIRMED

(Core :: JavaScript Engine, defect, P3)

Description

[konrad]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180808222917

Steps to reproduce:

Ran the following JavaScript code:

Object.getOwnPropertyDescriptor(Function.prototype, "arguments").get === Object.getOwnPropertyDescriptor(Function.prototype, "caller").get



Actual results:

I got boolean value false


Expected results:

I should get true.

This is because of step 2 in https://tc39.github.io/ecma262/#sec-addrestrictedfunctionproperties, specifically "Let thrower be realm.[[Intrinsics]].[[%ThrowTypeError%]].".

The thrower should be the same for both Function.prototype.arguments and Function.prototype.caller. Additionally, the specification provides a requirement for %ThrowTypeError% intrinsic that it "is defined once for each realm".

In Chrome, I get correctly true.

This is related to bug 1296237, although it is different.

Comment 2

[konrad]

I don't think this is a duplicate anymore as the ticket was closed for a reason that has nothing to do with this ticket.

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Safari also returns false for the test case above (but it does certainly appear that this is an issue... it seems like this should be put into test262 as a test case).

Comment 4

[André Bargull [:anba]]

This is covered in test262 by:

• built-ins/Function/prototype/restricted-property-arguments.js
• built-ins/Function/prototype/restricted-property-caller.js
• built-ins/ThrowTypeError/unique-per-realm-function-proto.js

The non-standard Function.caller and Function.prototype properties are implemented as accessors on Function.prototype in preparation of https://github.com/claudepache/es-legacy-function-reflection, so the current behaviour in SpiderMonkey is expected.