On Sep 26, 2006, at 7:37 AM, Boris Zbarsky wrote:

Maciej Stachowiak wrote:
You can't use "apply" with "new". What part of the spec says you can?

I haven't been able to find the part of the spec that addresses this at all. So the question could also be posed as "What part of the spec says you can't?"

"new" invokes the [[Construct]] internal property rather than the [[Call]] internal property, and Object.apply does not have the former.

Or to put it in slightly plainer English, you can only use "new" with a constructor, not a function, and while every user-defined function is a constructor, the same is not true of host functions; they can only be invoked as a constructor when the spec says so.

And apply is just an example; I don't know enough about the twisty details of ECMA to figure out what all else could be done to transplant functions; every time I think I've seen it all someone posts another security exploit that uses parts of ECMA I've never heard of in weird ways. ;)

I agree there can be strange edge cases at times, but this is not one of them afaict. Keep in mind that that the potential transplant here is a constructor, not a function.

Again, my real issue is that the attempt at "definition" that currently exists in the XMLHttpRequest spec doesn't make it clear what the terms it's using mean.

I agree the definition should be clear, I'll try to review the existing one and suggest more precise wording if needed.

Regards,
Maciej


Reply via email to