deno icon indicating copy to clipboard operation
deno copied to clipboard

Array accesses/stores need primordials

Open andreubotella opened this issue 4 years ago • 3 comments

Object.defineProperty(Array.prototype, "0", {
  set: (v) => {
    throw new Error("WTF");
  },
});
console.log("Test");
Test
error: Uncaught Error: WTF
    throw new Error("WTF");
          ^
    at <anonymous> (file:///home/abotella/test.js:3:11)

andreubotella avatar Aug 12 '21 22:08 andreubotella

I thought the array store in question in the above sample was in the console code, but it seems to happen when dealing with the load event:

Object.defineProperty(Array.prototype, "0", {
  get: () => {},
});
error: Uncaught TypeError: Cannot set property 0 of [object Array] which has only a getter
    at <anonymous> (deno:extensions/web/02_event.js:507:5)

andreubotella avatar Aug 13 '21 07:08 andreubotella

Rather than primordials, this is related to naive property dereferencing vs using Object.hasOwnProperty()/ Object.getOwnProperty(). But even e.g. Array.prototype.join() is susceptible to Array.prototype[0] modification: image The problem is entangled parts of our internal JS responding to that in less predictable ways. But it's hard to determine what is or isn't worth making more fault-tolerant if any of it.

nayeemrmn avatar Mar 25 '22 22:03 nayeemrmn

It doesn't seem to be happening right now. Is this resolved?

% deno --version  
deno 1.40.4 (release, aarch64-apple-darwin)
v8 12.1.285.6
typescript 5.3.3

Hajime-san avatar May 27 '24 03:05 Hajime-san