https://codereview.appspot.com/247900043/diff/1/src/com/google/caja/es53.js
File src/com/google/caja/es53.js (right):
https://codereview.appspot.com/247900043/diff/1/src/com/google/caja/es53.js#newcode721
src/com/google/caja/es53.js:721: if (fn.ok___ &&
fn.hasOwnProperty('ok___')) { return fn; }
On 2015/06/09 22:40:31, MarkM wrote:
I no longer remember specifically how ok___ was set up. But if it is
like a lot
of ES5/3's other markings, then its value is already the object that
it is own
on, precisely to make such own property checks cheap.
It isn't; it's a boolean. If you look at the review of the original
addition of this line, <https://codereview.appspot.com/5873043>, we
expected that markFunc would never be called with inheritance like this.
But perhaps as you point out we _should_ make it into (fn.ok___ === fn)
in these cases. I hope Mike can help clarify the issues here.
https://codereview.appspot.com/247900043/diff/1/src/com/google/caja/es53.js#newcode2633
src/com/google/caja/es53.js:2633: // native ES5 accessors.
On 2015/06/09 22:40:31, MarkM wrote:
Have we actually encountered this as an issue? How?
Yes, that's what https://github.com/google/caja/issues/1967 is. Chrome
44 has Function.prototype.arguments and Function.prototype.caller
accessors which throw.
I agree that there might be other problems lurking, but we'll have to
fix them as we see them, unless you're volunteering to do the complete
analysis. Hopefully we can kill ES5/3 for real before another one pops
up.
https://codereview.appspot.com/247900043/
--
---
You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
