Re: [whatwg/streams] Resolving promises with byte sequences results in UB (Issue #1178)

Glad I could help! 😁 

Anyway, while we're on the topic of resolving internal promises with possibly author-manipulated objects or non-IDL values, it looks like we have a few more problematic cases:
* In step 14.1.5 of [ReadableStreamPipeTo()](https://streams.spec.whatwg.org/commit-snapshots/5aec42e8cda85f15375d47db82a292ce2dbb0a64/#readable-stream-pipe-to), we use [get a promise for waiting for all](https://webidl.spec.whatwg.org/#waiting-for-all-promise). This constructs a `Promise<sequence<T>>`. When a sequence is [converted to an ECMAScript value](https://webidl.spec.whatwg.org/#es-sequence), we construct an `Array`. So... what stops anyone from defining `Array.prototype.then`? 😛 It sounds like "get a promise for waiting for all" is not safe for internal use, and specs should use ["wait for all"](https://webidl.spec.whatwg.org/#wait-for-all) instead.
* For [pair asynchronously iterable declarations](https://webidl.spec.whatwg.org/#idl-async-iterable), you're supposed to "resolve a promise with a pair". But [pair](https://infra.spec.whatwg.org/#pair) is an Infra type, so Web IDL doesn't know how to convert it to an ECMAScript value. However, Web IDL expects that "getting the next iteration result" will actually *return* a pair (step 7.5.3.1 of [the next() method](https://webidl.spec.whatwg.org/#es-asynchronous-iterator-prototype-object)), which is not possible. It sounds like "getting the next iteration result" should take callbacks instead, or perhaps return an "internal promise".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/streams/issues/1178#issuecomment-948099950