archives

« Bugzilla Issues Index

#3242 — 9.3.2 CreateBuiltinFunction: Directly assign [[Prototype]] slot instead of calling [[SetPrototypeOf]]


9.3.2 CreateBuiltinFunction(realm, steps, prototype, internalSlotsList) Abstract Operation

Step 5 needs to set the [[Prototype]] internal slot directly instead of calling the [[SetPrototypeOf]] internal method. Otherwise MakeArgGetter and MakeArgGetter creation can be observed by user code, for example when the [[Prototype]] of Object.prototype is a user-created Proxy object.


fixed in rev28 editor's draft


fixed in rev28