| Status quo - | With binding +### Node.js +Node.js’s runtime depends on many built-in JavaScript global intrinsic objects +that are vulnerable to mutation or prototype pollution by third-party libraries. +When initializing a JavaScript runtime, Node.js therefore caches +wrapped versions of every global intrinsic object (and its methods) +in a [large `primordials` object][primordials.js]. - |
|---|---|
| +Many of the global intrinsic methods inside of the `primordials` object +rely on the `this` binding. +`primordials` therefore contains numerous entries that look like this: +```js +ArrayPrototypeConcat: uncurryThis(Array.prototype.concat), +ArrayPrototypeCopyWithin: uncurryThis(Array.prototype.copyWithin), +ArrayPrototypeFill: uncurryThis(Array.prototype.fill), +ArrayPrototypeFind: uncurryThis(Array.prototype.find), +ArrayPrototypeFindIndex: uncurryThis(Array.prototype.findIndex), +ArrayPrototypeLastIndexOf: uncurryThis(Array.prototype.lastIndexOf), +ArrayPrototypePop: uncurryThis(Array.prototype.pop), +ArrayPrototypePush: uncurryThis(Array.prototype.push), +ArrayPrototypePushApply: applyBind(Array.prototype.push), +ArrayPrototypeReverse: uncurryThis(Array.prototype.reverse), +``` +…and so on, where `uncurryThis` is `Function.prototype.call.bind` +(also called [“call-binding”][call-bind]), +and `applyBind` is the similar `Function.prototype.apply.bind`. + +[call-bind]: https://npmjs.com/call-bind +In other words, Node.js must **wrap** every `this`-sensitive global intrinsic method +in a `this`-uncurried **wrapper function**, +whose first argument is the method’s `this` value, +using the `uncurryThis` helper function. + +The result is that code that uses these global intrinsic methods, +like this code adapted from [node/lib/internal/v8_prof_processor.js][]: ```js -??? + // `specifier` is a string. + const file = specifier.slice(2, -4); + + // Later… + if (process.platform === 'darwin') { + tickArguments.push('--mac'); + } else if (process.platform === 'win32') { + tickArguments.push('--windows'); + } + tickArguments.push(...process.argv.slice(1)); ``` -From ???. +…must instead look like this: +```js +// Note: This module assumes that it runs before any third-party code. +const { + ArrayPrototypePush, + ArrayPrototypePushApply, + ArrayPrototypeSlice, + StringPrototypeSlice, +} = primordials; + + // Later… + const file = StringPrototypeSlice(specifier, 2, -4); + + // Later… + if (process.platform === 'darwin') { + ArrayPrototypePush(tickArguments, '--mac'); + } else if (process.platform === 'win32') { + ArrayPrototypePush(tickArguments, '--windows'); + } + ArrayPrototypePushApply(tickArguments, ArrayPrototypeSlice(process.argv, 1)); +``` + +This code is now protected against prototype pollution by accident and by adversaries +(e.g., `delete Array.prototype.push` or `delete Array.prototype[Symbol.iterator]`). +However, this protection comes at two costs: + +1. These [uncurried wrapper functions sometimes dramatically reduce performance][#38248]. + This would not be a problem if Node.js could cache + and use the intrinsic methods directly. + But the only current way to use intrinsic methods + would be with `Function.prototype.call`, which is also vulnerable to mutation. - | +2. The Node.js community has had [much concern about barriers to contribution][#30697] + by ordinary JavaScript developers, due to the unidiomatic code encouraged by these + uncurried wrapper functions. + +Both of these problems are much improved by the bind-`this` operator. +Instead of wrapping every global method with `uncurryThis`, +Node.js could cached and used **directly** +without worrying about `Function.prototype.call` mutation: ```js -??? +// Note: This module assumes that it runs before any third-party code. +const $apply = Function.prototype.apply; +const $push = Array.prototype.push; +const $arraySlice = Array.prototype.slice; +const $stringSlice = String.prototype.slice; + + // Later… + const file = specifier->$stringSlice(2, -4); + + // Later… + if (process.platform === 'darwin') { + tickArguments->$push('--mac'); + } else if (process.platform === 'win32') { + tickArguments->$push('--windows'); + } + $push->$apply(tickArguments, process.argv->$arraySlice(1)); ``` - |
-title: ES bind operator (2021) +title: ES bind-this operator (2021) status: proposal stage: 0 location: https://github.com/js-choi/proposal-bind-operator @@ -12,7 +12,7 @@Introduction
This is the formal specification - for a proposed bind operator `->` in JavaScript. + for a proposed bind-`this` operator `->` in JavaScript. It modifies the original ECMAScript specification with several new or revised clauses. See Static Semantics: IsFunctionDefinition MemberExpression `.` PrivateIdentifier MemberExpression `->` `(` Expression `)` - MemberExpression `->` IdentifierReference + MemberExpression `->` IdentifierReference
@@ -277,12 +277,12 @@ Static Semantics: Early Errors
- This production exists in order to prevent automatic semicolon insertion rules (
+) from being applied to the following code with the bind operator: This production exists in order to prevent automatic semicolon insertion rules (
) from being applied to the following code with the bind-`this` operator: -a->b `c`so that it would be interpreted as two valid statements. The purpose is to maintain consistency with similar code without the bind operator:
+so that it would be interpreted as two valid statements. The purpose is to maintain consistency with similar code without the bind-`this` operator:
a.b `c` @@ -300,12 +300,12 @@Static Semantics: Early Errors
- This production exists in order to prevent automatic semicolon insertion rules (
+) from being applied to the following code with the bind operator: This production exists in order to prevent automatic semicolon insertion rules (
) from being applied to the following code with the bind-`this` operator: -a()->b `c`so that it would be interpreted as two valid statements. The purpose is to maintain consistency with similar code without the bind operator:
+so that it would be interpreted as two valid statements. The purpose is to maintain consistency with similar code without the bind-`this` operator:
a().b `c` @@ -323,12 +323,12 @@Static Semantics: Early Errors
- This production exists in order to prevent automatic semicolon insertion rules (
+) from being applied to the following code with the bind operator: This production exists in order to prevent automatic semicolon insertion rules (
) from being applied to the following code with the bind-`this` operator: -a?.()->b `c`so that it would be interpreted as two valid statements. The purpose is to maintain consistency with similar code without the bind operator:
+so that it would be interpreted as two valid statements. The purpose is to maintain consistency with similar code without the bind-`this` operator:
a?.().b `c` @@ -340,7 +340,7 @@Static Semantics: Early Errors
- Bind Operator
+Bind-`this` operator
This section is a wholly new subclause to be inserted after the 1. Return _F_.
- @@ -455,4 +455,27 @@Function objects created using the bind operator are exotic objects. They also do not have a *"prototype"* property.
+Function objects created using the bind-`this` operator are exotic objects. They also do not have a *"prototype"* property.
Runtime Semantics: ChainEvaluation
+ ++ Decorators
+Syntax
++ DecoratorList[Yield, Await] : + DecoratorList[?Yield, ?Await]? Decorator[?Yield, ?Await] + + Decorator[Yield, Await] : + `@init:` DecoratorMemberExpression[?Yield, ?Await] + `@init:` DecoratorCallExpression[?Yield, ?Await] + `@` DecoratorMemberExpression[?Yield, ?Await] + `@` DecoratorCallExpression[?Yield, ?Await] + + DecoratorMemberExpression[Yield, Await] : + IdentifierReference[?Yield, ?Await] + DecoratorMemberExpression[?Yield, ?Await] `.` IdentifierName + `(` Expression[+In, ?Yield, ?Await] `)` + + DecoratorCallExpression[Yield, Await] : + DecoratorMemberExpression[?Yield, ?Await] Arguments[?Yield, ?Await] + +