diff --git a/source b/source index a915a6c9444..ae0581a0669 100644 --- a/source +++ b/source @@ -2951,10 +2951,10 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • abstract closure
  • immutable prototype exotic object
  • Well-Known Symbols, including - @@hasInstance, - @@isConcatSpreadable, - @@toPrimitive, and - @@toStringTag
  • + %Symbol.hasInstance%, + %Symbol.isConcatSpreadable%, + %Symbol.toPrimitive%, and + %Symbol.toStringTag%
  • Well-Known Intrinsic Objects, including %Array.prototype%, %Error.prototype%, @@ -88729,8 +88729,8 @@ dictionary DragEventInit : MouseEventInit {
    CrossOriginPropertyFallback ( P )
      -
    1. If P is "then", @@toStringTag, - @@hasInstance, or @@isConcatSpreadable, then return +

    2. If P is "then", %Symbol.toStringTag%, + %Symbol.hasInstance%, or %Symbol.isConcatSpreadable%, then return PropertyDescriptor{ [[Value]]: undefined, [[Writable]]: false, @@ -88908,7 +88908,7 @@ dictionary DragEventInit : MouseEventInit { data-x="list append">append e.[[Property]] to keys.

    3. Return the concatenation of keys and « "then", - @@toStringTag, @@hasInstance, @@isConcatSpreadable + %Symbol.toStringTag%, %Symbol.hasInstance%, %Symbol.isConcatSpreadable% ».

    @@ -90412,7 +90412,7 @@ interface BarProp { [[Enumerable]]: false, [[Configurable]]: false }).

  • -
  • Perform ! location.[[DefineOwnProperty]](@@toPrimitive, { +

  • Perform ! location.[[DefineOwnProperty]](%Symbol.toPrimitive%, { [[Value]]: undefined, [[Writable]]: false, [[Enumerable]]: false, @@ -90424,12 +90424,12 @@ interface BarProp {

  • Return location.

  • -

    The addition of valueOf and @@toPrimitive own +

    The addition of valueOf and %Symbol.toPrimitive% own data properties, as well as the fact that all of Location's IDL attributes are marked [LegacyUnforgeable], is required by legacy code that consulted the Location interface, or stringified it, to determine the document URL, and then used it in a security-sensitive way. - In particular, the valueOf, @@toPrimitive, and valueOf, %Symbol.toPrimitive%, and [LegacyUnforgeable] stringifier mitigations ensure that code such as foo[location] = bar or location + "" cannot be misdirected.