diff --git a/source b/source index a915a6c9444..ae0581a0669 100644 --- a/source +++ b/source @@ -2951,10 +2951,10 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
If P is "then
", @@toStringTag,
- @@hasInstance, or @@isConcatSpreadable, then return
+
If P is "then
", %Symbol.toStringTag%,
+ %Symbol.hasInstance%, or %Symbol.isConcatSpreadable%, then return
PropertyDescriptor{
[[Value]]: undefined,
[[Writable]]: false,
@@ -88908,7 +88908,7 @@ dictionary DragEventInit : MouseEventInit {
data-x="list append">append e.[[Property]] to keys.
Return the concatenation of keys and « "then
",
- @@toStringTag, @@hasInstance, @@isConcatSpreadable
+ %Symbol.toStringTag%, %Symbol.hasInstance%, %Symbol.isConcatSpreadable%
».
Perform ! location.[[DefineOwnProperty]](@@toPrimitive, { +
Perform ! location.[[DefineOwnProperty]](%Symbol.toPrimitive%, { [[Value]]: undefined, [[Writable]]: false, [[Enumerable]]: false, @@ -90424,12 +90424,12 @@ interface BarProp {
Return location.
The addition of valueOf
and @@toPrimitive own
+
The addition of valueOf
and %Symbol.toPrimitive% own
data properties, as well as the fact that all of Location
's IDL attributes are marked
[LegacyUnforgeable]
, is required by legacy code that consulted
the Location
interface, or stringified it, to determine the document URL, and then used it in a security-sensitive way.
- In particular, the valueOf
, @@toPrimitive, and valueOf
, %Symbol.toPrimitive%, and [LegacyUnforgeable]
stringifier mitigations ensure that code such as
foo[location] = bar
or location + ""
cannot be
misdirected.