archives

« Bugzilla Issues Index

#310 — problems with restrictions on non-strict Function caller property


15.3.5.4 should have redefined [[GetOwnProperty]] instead of [[Get]] to restrict access to strict-mode functions from non-strict code.

AllenWB:

OK, it looks like the addition of line 6 of 15.3.4.5 was an error. Line 20 and the informative note in 15.3.5.4 had been around for quite a while when lines 5 and 6 were added in the August 31, 2009 ES5 draft. Technically line 5 is needed and I probably also added line 6 to also incorporate 15.3.5.4 but didn't notice that line 20 made it unnecessary.

I'm disinclined to do anything at all for non-strict caller other than correcting the spec. to use [[GetOwnProperty]] instead of [[Get]]. I'm haven't yet heard any real interoperability issues involving this non-standard feature and unless there are I don't thing we should do anything beyond the minimum necessary to ensure "caller" doesn't leak strict callers form the call stack. As I mentioned earlier, we might consider just specify that as a requirement and moving a away for an algorithmic spec. for this mis-feature.


Special casing [[GetOwnProperty]] in 15.3.5.4 is what V8 (and FF) implements, but it actually causes a serious issue with Object.{seal,freeze,IsSealed,isFrozen}. These functions apply [[GetOwnProperty]] to all properties, and will hence throw with the proposed change when applied to the wrong function at the wrong time. In fact, they do in V8, e.g. try:

d8> function g() { Object.seal(g) }
d8> function f() { "use strict"; g() }
d8> f()
(d8):1: TypeError: Illegal access to a strict mode caller function.

Interestingly, Firefox does not throw on that example, so I'm not sure what semantics it actually implements.

As for the rest of your comment, I agree that 15.3.4.5 line 6 (along with the second half of line 5) is unnecessary.


(In reply to comment #1)
> Special casing [[GetOwnProperty]] in 15.3.5.4 is what V8 (and FF) implements,
> but it actually causes a serious issue with
> Object.{seal,freeze,IsSealed,isFrozen}. These functions apply
> [[GetOwnProperty]] to all properties, and will hence throw with the proposed
> change when applied to the wrong function at the wrong time. In fact, they do
> in V8, e.g. try:
>
> d8> function g() { Object.seal(g) }
> d8> function f() { "use strict"; g() }
> d8> f()
> (d8):1: TypeError: Illegal access to a strict mode caller function.
>
> Interestingly, Firefox does not throw on that example, so I'm not sure what
> semantics it actually implements.

See https://mail.mozilla.org/pipermail/es-discuss/2012-November/026410.html for what FF does, and an alternative fix: do not throw from [[GetOwnProperty]] on a strict function's 'caller', rather return a pd with a censored or poisoned .value property.

/be


See https://bugs.ecmascript.org/show_bug.cgi?id=3113


Seems invalid for ES2015.