Bug related to using `Object.__proto__` within async call?

[tizmagik]

Version

v22.8.0

Platform

Darwin MacBook-Pro-103.local 23.6.0 Darwin Kernel Version 23.6.0: Mon Jul 29 21:14:30 PDT 2024; root:xnu-10063.141.2~1/RELEASE_ARM64_T6030 arm64

Subsystem

No response

What steps will reproduce the bug?

Using Object.__proto__ inside async call.

See minimal reproduction repo: https://github.com/tizmagik/async-object-proto-repro

How often does it reproduce? Is there a required condition?

Every time

What is the expected behavior? Why is that the expected behavior?

Should behave similarly to sync call

What do you see instead?

Async thread appears to exit early or crash, although no visible output

Additional information

https://github.com/tizmagik/async-object-proto-repro

[tizmagik]

I also posted this to Chromium v8 tracker -- sorry I'm not sure exactly where is the correct place to report this: https://partnerissuetracker.corp.google.com/issues/366268202

[avivkeller]

I also posted this to Chromium v8 tracker -- sorry I'm not sure exactly where is the correct place to report this: https://partnerissuetracker.corp.google.com/issues/366268202

👋 did you happen to report it in an internal tracker? It doesn’t seem like that is accessible from non-google.com emails.

[avivkeller]

Repro:

console.log("BEFORE");
await new Promise((resolve, reject) =>
  resolve({ __proto__: new Proxy({}, { get: () => () => {} }) })
);
console.log("AFTER");

---

@nodejs/loaders when running the file using typeless module detection, the program silently exists.

However, when running the file from a .mjs file, the following is shown:

Warning: Detected unsettled top-level await at file:///repro.mjs:2

That behavior is being tracked at #54931

---

The issue isn't with the Proxy, it's with the promise. Take a look at the following repro:

await { then() {} };

This won't execute successfully.

The proxy is returning a function for the then value, so it's throwing the same error as the code above would.

[avivkeller]

Chromium displays the same behavior:

await { then() {} }; console.log('after');

'after' will never be logged.

[ljharb]

I think the issue is that you've made an object whose [[Prototype]] is a Proxy (not Object.__proto__, and that phrasing may be confusing to many)

[avivkeller]

I think the issue is that you've made an object whose [[Prototype]] is a Proxy (not Object.__proto__, and that phrasing may be confusing to many)

From what I can tell, the proxy prototype is working as expected, it just crashes when it tries to get the then value

[aduh95]

Object.__proto__ is not used at all in the repro (at least in #54930 (comment)). But anyway, what would you expect to happen? If the promise never resolves, the code after the await is never run, that's definitely aligned with the spec. It's the exact same behavior as await new Proxy({}, { get: () => () => {} }), or await new Promise(() => {}), or await { then() {} }.

Closing as Working as expected, let me know if I missed something.