857529 - Initializing a function's prototype in its ctor doesn't reliably work in self-hosted code

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Till Schneidereit [:till]]

The resolution of bug 837941 was to move the initialization of the List class's prototype out of the class's constructor.

The following:

function List() {
    if (List.prototype === undefined) {
        var proto = std_Object_create(null);
        proto.indexOf = std_Array_indexOf;
        proto.join = std_Array_join;
        proto.push = std_Array_push;
        proto.slice = std_Array_slice;
        proto.sort = std_Array_sort;
        List.prototype = proto;
    }
}

was changed to this:

function List() {}
{
  let ListProto = std_Object_create(null);
  ListProto.indexOf = std_Array_indexOf;
  ListProto.join = std_Array_join;
  ListProto.push = std_Array_push;
  ListProto.slice = std_Array_slice;
  ListProto.sort = std_Array_sort;
  List.prototype = ListProto;
}

While this is actually much saner, the previous version should have worked just as well. Unfortunately, I've got no idea whatsoever why it didn't.

Comment 1

[Brian Hackett [Laid off!]]

The 'prototype' property of a function is an empty object until it is explicitly assigned another value, so the test in the first case will never succeed.  (This property is internally managed via the resolve hook on the function class).

Comment 2

[Till Schneidereit [:till]]

(In reply to Brian Hackett (:bhackett) from comment #1)
> The 'prototype' property of a function is an empty object until it is
> explicitly assigned another value, so the test in the first case will never
> succeed.  (This property is internally managed via the resolve hook on the
> function class).

Oh, that's interesting. And makes total sense, of course. What doesn't make sense, then, is that this apparently worked when cloning List into other compartments. Maybe it just worked because the prototype wasn't properly cloned if it wasn't explicitly set? I'll test that, as it seems somewhat likely.

Comment 3

[Norbert Lindenberg]

Actually, self-hosted functions don't have a prototype property; the resolve hook for functions treats them as built-in functions thanks to bug 784300.

Comment 4

[Till Schneidereit [:till]]

I think we just don't want to do anything about this.