Function.prototype.toString throws for a revoked Proxy

[d01c2]

Reproduction

const r = Proxy.revocable(function(){}, {});
r.revoke();
Function.prototype.toString.call(r.proxy);

Expected

A NativeFunction string.

V8 (15.6.20):

$ v8 -e 'const r = Proxy.revocable(function(){}, {}); r.revoke(); print(Function.prototype.toString.call(r.proxy));'
function () { [native code] }

Actual (QuickJS-ng)

$ qjs -e 'const r = Proxy.revocable(function(){}, {}); r.revoke(); print(Function.prototype.toString.call(r.proxy));'
TypeError: revoked proxy

Spec

Function.prototype.toString returns a NativeFunction string when func is an Object and IsCallable(func) is true. It reaches its TypeError only when that test fails.

IsCallable returns true whenever the argument has a [[Call]] internal method. Revoking a Proxy clears [[ProxyHandler]] and [[ProxyTarget]]; it does not remove [[Call]], and IsCallable consults neither. So nothing here touches the revoked state.

JavaScriptCore, SpiderMonkey, GraalJS and V8 all return a NativeFunction string.

Versions

• QuickJS-ng: 0.17.0
• V8: 15.6.20