601329 - ToPropertyDescriptor({}) erroneously completes the property descriptor with missing attributes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Tom Van Cutsem]

According to the ES5 spec., ToPropertyDescriptor({}) should return a completely empty property descriptor. The implementation currently seems to auto-complete this descriptor to { value: (void 0), writable: false, enumerable: false, configurable: false }.

Without proxies, I think this was unobservable to JS code, but with the addition of proxies this changes:

var x;
var p = Proxy.create({
  defineProperty: function(name, desc) { x = ('value' in desc); }
});
Object.defineProperty(p, 'foo', {});

x is true while it should be false.

Comment 1

[Tom Van Cutsem]

I would like to draw renewed attention to this open issue:

Problem: property descriptor objects are currently always fully completed before being passed to a proxy handler's defineProperty trap.
The ES5 and harmony:proxies spec do not require the property descriptor to be completed, only for it to be "normalized".
Not completing the descriptor is necessary for proxies to be able to accurately emulate the built-in [[DefineOwnProperty]] algorithm (whose behavior depends on the presence or absence of attributes), and for proxies to be able to handle changes to just a single attribute of an existing property. Consider:

var o = { x: 1 };
Object.defineProperty(o, 'x', { writable: false}); // will only set writable from true to false, and leave other attributes untouched
Object.getOwnPropertyDescriptor(o, 'x').configurable; // is still 'true'

// now try to do the same on a proxy
var target = { x: 1 };
var p = Proxy.create({
  getOwnPropertyDescriptor: function(name) { return Object.getOwnPropertyDescriptor(target, name); },
  defineProperty: function(name, desc) { Object.defineProperty(target, name, desc); return true; }
});
// since desc is completed in the current implementation, the following call will actually be
// interpreted as Object.defineProperty(p, 'x', {writable:false,configurable:false,enumerable:false,value:undefined})
// which is probably not what the programmer intended
Object.defineProperty(p, 'x', { writable: false }); null; // null added to ensure p doesn't need to be printed to the shell
Object.getOwnPropertyDescriptor(p, 'x').configurable; // expected 'true' but is currently 'false'

Comment 2

[Brendan Eich [:brendan]]

Need an owner for this bug.

/be

Comment 3

[David Bruant]

Updated test case:
===
var d;
var p = new Proxy({}, {
  defineProperty: function(target, name, desc) { d = desc; }
});
Object.defineProperty(p, 'foo', {});

console.log('d', d);
===
It works with direct proxies. Closing this bug as fixed.