Need safer expansion

[erights]

Even under SES, the currently proposed expansion of bob~.foo(carol) to

Promise.resolve(bob).post('foo', [carol])

is not actually safe against reentrancy. It would be if, under SES, all genuine promises were born frozen. However, SES has not specified this, and it is hard (possibly impossible) for a SES shim to enforce without an invasive rewrite. Given that genuine SES promises are not born frozen, someone could add a .post method override as an own property to a genuine bob promise before the above operation.

Instead,

• the expansion should be in terms of calls to known functions, rather than late-bound calls to methods.
• the spec should specify that the syntax expands to the original/internal form of these functions, so that even non-SES implementors of the spec have the safety property.

Possible expansions:

E.post(bob, 'foo', [carol])
E.get(bob, 'foo')
E.put(bob, 'foo', newValue)
E.delete(bob, 'foo')

If we do that, the analogy between these are corresponding Reflect methods becomes strong, so we should also adopt the Reflect terminology:

E.apply(bob, 'foo', [carol])
E.get(bob, 'foo')
E.set(bob, 'foo', newValue)
E.deleteProperty(bob, 'foo')

Given that E itself is frozen under SES, under SES this would already be a safe expansion. Only outside of SES is the divergence between the safety of the speced "original/internal" vs the expansion observable, which is fine.

Should E be global? Probably not. It should be exported from a js: standardized builtin module.

[erights]

Hi @michaelfig I think you already fixed this and can close it out. So can I assign it to you?

[michaelfig]

Hi @michaelfig I think you already fixed this and can close it out. So can I assign it to you?

Yes, this is done.