Warning message when there is an attempt to overwrite __proto__

[josephrocca]

@kitsonk In this comment you mentioned that you'd prefer not to throw an error when __proto__ is overwritten like foo.__proto__=bar (as opposed to setPrototypeOf). I wonder what you (and other Deno devs) think about throwing a one-off warning message instead?

I'm porting a tangle of browser code across (the node XMLHttpRequest polyfill using browserify, so that I can get Pyodide running in Deno) and just fixed a somewhat "silent" bug that was caused by this. Luckily I'd just created #10221 for curiosity's sake, so it was quicker to track down, but it still took me an hour because I didn't realise that there was another attempted __proto__ edit in the codebase. I imagine that some others won't have as easy a time, because it's definitly not obvious that __proto__ would be frozen in Deno, while being editable in browsers.

I think an error would actually make some sense - better to crash the server (and thus alert the admin) than have silent bugs lurking. But a console.warn would be a good middle ground perhaps.

Cheers!

[josephrocca]

Also, perhaps the warning message could point developers to use setPrototypeOf instead? This saved the day for me, and I wouldn't had known about it unless I visited the __proto__ MDN page in desparation - I really didn't want to rewrite the browserify Buffer module.

[bartlomieju]

@josephrocca so you're suggesting to print a warning when a code like this is executed: foo.__proto__= bar;? I don't think that's really feasible

[josephrocca]

@bartlomieju Yes - just the first time that something like that is attempted (future occurrences would be silent). But if it's not feasible, then I'll close this. I think overwriting __proto__ isn't common enough that this is a huge problem - so long as libraries/frameworks/tooling/etc. (like this) can transition to setPrototypeOf, then it shouldn't be too much of a problem. The "silentness" of the current situation is a bit worrying to me though - it's not obvious to a dev that they'd need to change this in their codebase when they move to Deno, and so could result in sneaky bugs.