Proxy getOwnPropertyDescriptor trap accepts an incompatible descriptor for a non-configurable property

[d01c2]

Reproduction

const target = Object.defineProperty({}, "x", { value: 1 });

Object.getOwnPropertyDescriptor(
  new Proxy(target, { getOwnPropertyDescriptor() { return { value: 2 }; }}),
  "x"
);

Expected

A TypeError is thrown.

V8 (15.3.27):

d8> Object.getOwnPropertyDescriptor(new Proxy(target, { getOwnPropertyDescriptor() { return { value: 2 }; } }), "x");
TypeError: 'getOwnPropertyDescriptor' on proxy: trap returned descriptor for property 'x' that is incompatible with the existing property in the proxy target

Actual (QuickJS-ng)

QuickJS-ng accepts the incompatible descriptor:

qjs > Object.getOwnPropertyDescriptor(new Proxy(target, { getOwnPropertyDescriptor() { return { value: 2 }; } }), "x");
{ value: 2, writable: false, enumerable: false, configurable: false }

Spec

The target's "x" property is a non-configurable, non-writable data property whose value is 1.

The Proxy [[GetOwnProperty]] method converts and completes the descriptor returned by the getOwnPropertyDescriptor trap, then checks it using IsCompatiblePropertyDescriptor.

A non-configurable, non-writable data property cannot be reported with a different value. Since the trap reports the value as 2, the descriptor is incompatible with the target's existing property and [[GetOwnProperty]] must throw a TypeError.

Versions

• QuickJS-ng: 0.16.0
• V8: 15.3.27