refactor(ses): Capture Error and RegExp as FERAL_*

packages/ses/index.js

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { globalThis, Error, assign } from './src/commons.js';
+import { globalThis, TypeError, assign } from './src/commons.js';
 import { tameFunctionToString } from './src/tame-function-tostring.js';
 import { getGlobalIntrinsics } from './src/intrinsics.js';
 import { getAnonymousIntrinsics } from './src/get-anonymous-intrinsics.js';
@@ -29,7 +29,7 @@ function getThis() {
 }
 
 if (getThis()) {
-  throw new Error(`SES failed to initialize, sloppy mode (SES_NO_SLOPPY)`);
+  throw new TypeError(`SES failed to initialize, sloppy mode (SES_NO_SLOPPY)`);
 }
 
 const markVirtualizedNativeFunction = tameFunctionToString();

packages/ses/src/commons.js

@@ -28,15 +28,18 @@ export const {
   Promise,
   Proxy,
   Reflect,
-  RegExp,
+  RegExp: FERAL_REG_EXP,
   Set,
   String,
   WeakMap,
   WeakSet,
 } = globalThis;
 
 export const {
-  Error,
+  // The feral Error constructor is safe for internal use, but must not be
+  // revealed to post-lockdown code in any compartment including the start
+  // compartment since in V8 at least it bears stack inspection capabilities.
+  Error: FERAL_ERROR,
   RangeError,
   ReferenceError,
   SyntaxError,

packages/ses/src/compartment-shim.js

@@ -3,7 +3,6 @@
 /// <reference types="ses">
 
 import {
-  Error,
   Map,
   ReferenceError,
   TypeError,
@@ -265,7 +264,7 @@ export const makeCompartmentConstructor = (
       identifier => !isValidIdentifierName(identifier),
     );
     if (invalidNames.length) {
-      throw new Error(
+      throw new TypeError(
         `Cannot create compartment with invalid names for global lexicals: ${arrayJoin(
           invalidNames,
           ', ',

packages/ses/src/enable-property-overrides.js

@@ -4,7 +4,6 @@
 // @ts-check
 
 import {
-  Error,
   Set,
   String,
   TypeError,
@@ -114,7 +113,7 @@ export default function enablePropertyOverrides(
         } else {
           if (isDebug) {
             // eslint-disable-next-line @endo/no-polymorphic-call
-            console.error(new Error(`Override property ${prop}`));
+            console.error(new TypeError(`Override property ${prop}`));
           }
           defineProperty(this, prop, {
             value: newValue,
@@ -196,7 +195,7 @@ export default function enablePropertyOverrides(
       break;
     }
     default: {
-      throw new Error(`unrecognized overrideTaming ${overrideTaming}`);
+      throw new TypeError(`unrecognized overrideTaming ${overrideTaming}`);
     }
   }
 

packages/ses/src/error/assert.js

@@ -12,7 +12,7 @@
 // module should not be observably impure.
 
 import {
-  Error,
+  FERAL_ERROR,
   RangeError,
   TypeError,
   WeakMap,
@@ -85,7 +85,7 @@ const getMessageString = ({ template, args }) => {
     let argStr;
     if (weakmapHas(declassifiers, arg)) {
       argStr = `${arg}`;
-    } else if (arg instanceof Error) {
+    } else if (arg instanceof FERAL_ERROR) {
       argStr = `(${an(arg.name)})`;
     } else {
       argStr = `(${an(typeof arg)})`;
@@ -226,7 +226,7 @@ const tagError = (err, optErrorName = err.name) => {
  */
 const makeError = (
   optDetails = redactedDetails`Assert failed`,
-  ErrorConstructor = Error,
+  ErrorConstructor = FERAL_ERROR,
   { errorName = undefined } = {},
 ) => {
   if (typeof optDetails === 'string') {
@@ -236,7 +236,7 @@ const makeError = (
   }
   const hiddenDetails = weakmapGet(hiddenDetailsMap, optDetails);
   if (hiddenDetails === undefined) {
-    throw new Error(`unrecognized details ${quote(optDetails)}`);
+    throw new TypeError(`unrecognized details ${quote(optDetails)}`);
   }
   const messageString = getMessageString(hiddenDetails);
   const error = new ErrorConstructor(messageString);
@@ -286,7 +286,7 @@ const note = (error, detailsNote) => {
   }
   const hiddenDetails = weakmapGet(hiddenDetailsMap, detailsNote);
   if (hiddenDetails === undefined) {
-    throw new Error(`unrecognized details ${quote(detailsNote)}`);
+    throw new TypeError(`unrecognized details ${quote(detailsNote)}`);
   }
   const logArgs = getLogArgs(hiddenDetails);
   const callbacks = weakmapGet(hiddenNoteCallbackArrays, error);
@@ -365,7 +365,7 @@ const makeAssert = (optRaise = undefined, unredacted = false) => {
   /** @type {AssertFail} */
   const fail = (
     optDetails = details`Assert failed`,
-    ErrorConstructor = Error,
+    ErrorConstructor = FERAL_ERROR,
   ) => {
     const reason = makeError(optDetails, ErrorConstructor);
     if (optRaise !== undefined) {
@@ -382,7 +382,7 @@ const makeAssert = (optRaise = undefined, unredacted = false) => {
   function baseAssert(
     flag,
     optDetails = details`Check failed`,
-    ErrorConstructor = Error,
+    ErrorConstructor = FERAL_ERROR,
   ) {
     if (!flag) {
       throw fail(optDetails, ErrorConstructor);

packages/ses/src/error/console.js

@@ -6,7 +6,7 @@
 // normally commented out.
 
 import {
-  Error,
+  FERAL_ERROR,
   WeakSet,
   arrayFilter,
   arrayMap,
@@ -197,7 +197,7 @@ const makeCausalConsole = (baseConsole, loggedErrorHandler) => {
    */
   const extractErrorArgs = (logArgs, subErrorsSink) => {
     const argTags = arrayMap(logArgs, arg => {
-      if (arg instanceof Error) {
+      if (arg instanceof FERAL_ERROR) {
         arrayPush(subErrorsSink, arg);
         return `(${tagError(arg)})`;
       }

packages/ses/src/error/stringify-utils.js

@@ -1,7 +1,7 @@
 // @ts-check
 
 import {
-  Error,
+  FERAL_ERROR,
   Set,
   String,
   freeze,
@@ -70,7 +70,7 @@ const bestEffortStringify = (payload, spaces = undefined) => {
           return '[Seen]';
         }
         setAdd(seenSet, val);
-        if (val instanceof Error) {
+        if (val instanceof FERAL_ERROR) {
           return `[${val.name}: ${val.message}]`;
         }
         if (toStringTagSymbol in val) {

packages/ses/src/error/tame-console.js

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { Error, globalThis } from '../commons.js';
+import { TypeError, globalThis } from '../commons.js';
 import { loggedErrorHandler as defaultHandler } from './assert.js';
 import { makeCausalConsole } from './console.js';
 import './types.js';
@@ -25,7 +25,7 @@ export const tameConsole = (
   optGetStackString = undefined,
 ) => {
   if (consoleTaming !== 'safe' && consoleTaming !== 'unsafe') {
-    throw new Error(`unrecognized consoleTaming ${consoleTaming}`);
+    throw new TypeError(`unrecognized consoleTaming ${consoleTaming}`);
   }
 
   if (consoleTaming === 'unsafe') {

packages/ses/src/error/tame-error-constructor.js

@@ -1,5 +1,6 @@
 import {
-  Error,
+  FERAL_ERROR,
+  TypeError,
   apply,
   construct,
   defineProperties,
@@ -11,7 +12,7 @@ import { tameV8ErrorConstructor } from './tame-v8-error-constructor.js';
 
 // Present on at least FF. Proposed by Error-proposal. Not on SES whitelist
 // so grab it before it is removed.
-const stackDesc = getOwnPropertyDescriptor(Error.prototype, 'stack');
+const stackDesc = getOwnPropertyDescriptor(FERAL_ERROR.prototype, 'stack');
 const stackGetter = stackDesc && stackDesc.get;
 
 // Use concise methods to obtain named functions without constructors.
@@ -32,30 +33,29 @@ export default function tameErrorConstructor(
   stackFiltering = 'concise',
 ) {
   if (errorTaming !== 'safe' && errorTaming !== 'unsafe') {
-    throw new Error(`unrecognized errorTaming ${errorTaming}`);
+    throw new TypeError(`unrecognized errorTaming ${errorTaming}`);
   }
   if (stackFiltering !== 'concise' && stackFiltering !== 'verbose') {
-    throw new Error(`unrecognized stackFiltering ${stackFiltering}`);
+    throw new TypeError(`unrecognized stackFiltering ${stackFiltering}`);
   }
-  const OriginalError = Error;
-  const ErrorPrototype = OriginalError.prototype;
+  const ErrorPrototype = FERAL_ERROR.prototype;
 
   const platform =
-    typeof OriginalError.captureStackTrace === 'function' ? 'v8' : 'unknown';
-  const { captureStackTrace: originalCaptureStackTrace } = OriginalError;
+    typeof FERAL_ERROR.captureStackTrace === 'function' ? 'v8' : 'unknown';
+  const { captureStackTrace: originalCaptureStackTrace } = FERAL_ERROR;
 
   const makeErrorConstructor = (_ = {}) => {
     // eslint-disable-next-line no-shadow
     const ResultError = function Error(...rest) {
       let error;
       if (new.target === undefined) {
-        error = apply(OriginalError, this, rest);
+        error = apply(FERAL_ERROR, this, rest);
       } else {
-        error = construct(OriginalError, rest, new.target);
+        error = construct(FERAL_ERROR, rest, new.target);
       }
       if (platform === 'v8') {
         // TODO Likely expensive!
-        apply(originalCaptureStackTrace, OriginalError, [error, ResultError]);
+        apply(originalCaptureStackTrace, FERAL_ERROR, [error, ResultError]);
       }
       return error;
     };
@@ -100,9 +100,9 @@ export default function tameErrorConstructor(
   defineProperties(InitialError, {
     stackTraceLimit: {
       get() {
-        if (typeof OriginalError.stackTraceLimit === 'number') {
-          // OriginalError.stackTraceLimit is only on v8
-          return OriginalError.stackTraceLimit;
+        if (typeof FERAL_ERROR.stackTraceLimit === 'number') {
+          // FERAL_ERROR.stackTraceLimit is only on v8
+          return FERAL_ERROR.stackTraceLimit;
         }
         return undefined;
       },
@@ -114,9 +114,9 @@ export default function tameErrorConstructor(
           // harmless seems the safer option.
           return;
         }
-        if (typeof OriginalError.stackTraceLimit === 'number') {
-          // OriginalError.stackTraceLimit is only on v8
-          OriginalError.stackTraceLimit = newLimit;
+        if (typeof FERAL_ERROR.stackTraceLimit === 'number') {
+          // FERAL_ERROR.stackTraceLimit is only on v8
+          FERAL_ERROR.stackTraceLimit = newLimit;
           // We place the useless return on the next line to ensure
           // that anything we place after the if in the future only
           // happens if the then-case does not.
@@ -149,7 +149,7 @@ export default function tameErrorConstructor(
   let initialGetStackString = tamedMethods.getStackString;
   if (platform === 'v8') {
     initialGetStackString = tameV8ErrorConstructor(
-      OriginalError,
+      FERAL_ERROR,
       InitialError,
       errorTaming,
       stackFiltering,

packages/ses/src/get-anonymous-intrinsics.js

@@ -2,7 +2,7 @@ import {
   FERAL_FUNCTION,
   Float32Array,
   Map,
-  RegExp,
+  FERAL_REG_EXP,
   Set,
   String,
   getOwnPropertyDescriptor,
@@ -57,7 +57,7 @@ export const getAnonymousIntrinsics = () => {
 
   // 21.2.7.1 The %RegExpStringIteratorPrototype% Object
   const RegExpStringIterator =
-    regexpPrototype[matchAllSymbol] && matchAllRegExp(new RegExp());
+    regexpPrototype[matchAllSymbol] && matchAllRegExp(new FERAL_REG_EXP());
   const RegExpStringIteratorPrototype =
     RegExpStringIterator && getPrototypeOf(RegExpStringIterator);
 

packages/ses/src/get-source-url.js

@@ -1,4 +1,4 @@
-import { RegExp, regexpExec, stringSlice } from './commons.js';
+import { FERAL_REG_EXP, regexpExec, stringSlice } from './commons.js';
 
 // Captures a key and value of the form #key=value or @key=value
 const sourceMetaEntryRegExp =
@@ -9,7 +9,7 @@ const sourceMetaEntryRegExp =
 // On account of the mechanics of regular expressions, scanning from the end
 // does not allow us to capture every pair, so getSourceURL must capture and
 // trim until there are no matching comments.
-const sourceMetaEntriesRegExp = new RegExp(
+const sourceMetaEntriesRegExp = new FERAL_REG_EXP(
   `(?:\\s*//${sourceMetaEntryRegExp}|/\\*${sourceMetaEntryRegExp}\\s*\\*/)\\s*$`,
 );
 

packages/ses/src/intrinsics.js

@@ -1,6 +1,6 @@
 import {
-  Error,
   Object,
+  TypeError,
   WeakSet,
   arrayFilter,
   defineProperty,
@@ -41,7 +41,7 @@ function initProperty(obj, name, desc) {
       preDesc.enumerable !== desc.enumerable ||
       preDesc.configurable !== desc.configurable
     ) {
-      throw new Error(`Conflicting definitions of ${name}`);
+      throw new TypeError(`Conflicting definitions of ${name}`);
     }
   }
   defineProperty(obj, name, desc);
@@ -93,22 +93,22 @@ export const makeIntrinsicsCollector = () => {
       }
       const permit = whitelist[name];
       if (typeof permit !== 'object') {
-        throw new Error(`Expected permit object at whitelist.${name}`);
+        throw new TypeError(`Expected permit object at whitelist.${name}`);
       }
       const namePrototype = permit.prototype;
       if (!namePrototype) {
-        throw new Error(`${name}.prototype property not whitelisted`);
+        throw new TypeError(`${name}.prototype property not whitelisted`);
       }
       if (
         typeof namePrototype !== 'string' ||
         !objectHasOwnProperty(whitelist, namePrototype)
       ) {
-        throw new Error(`Unrecognized ${name}.prototype whitelist entry`);
+        throw new TypeError(`Unrecognized ${name}.prototype whitelist entry`);
       }
       const intrinsicPrototype = intrinsic.prototype;
       if (objectHasOwnProperty(intrinsics, namePrototype)) {
         if (intrinsics[namePrototype] !== intrinsicPrototype) {
-          throw new Error(`Conflicting bindings of ${namePrototype}`);
+          throw new TypeError(`Conflicting bindings of ${namePrototype}`);
         }
         // eslint-disable-next-line no-continue
         continue;
@@ -127,7 +127,7 @@ export const makeIntrinsicsCollector = () => {
 
   const isPseudoNative = obj => {
     if (!pseudoNatives) {
-      throw new Error(
+      throw new TypeError(
         'isPseudoNative can only be called after finalIntrinsics',
       );
     }

packages/ses/src/module-instance.js

@@ -1,7 +1,6 @@
 import { assert } from './error/assert.js';
 import { getDeferredExports } from './module-proxy.js';
 import {
-  Error,
   ReferenceError,
   SyntaxError,
   TypeError,
@@ -175,7 +174,7 @@ export const makeModuleInstance = (
         // init with initValue of a declared const binding, and return
         // it.
         if (!tdz) {
-          throw new Error(
+          throw new TypeError(
             `Internal: binding ${q(localName)} already initialized`,
           );
         }