Why deprecate function caller access?

[=?UTF-8?B?QW50w7NuaW8gTWFycXVlcw==?=]

Hi,

Sorry if this's been discussed before, I couldn't find it.
As well you know, the ECMAScript standard doesn't include any way to
access a function's caller. This has been available on Mozilla and IE as
a 'caller' property of function objects, and it seems Konqueror/Safari
now have it too. Opera doesn't. And what bothers me is that it is marked
as 'deprecated'.

I've seen people I respect swear by their lives that it is *good* to
have it deprecated. 'Because there are better ways of doing what you
want'. I can't understand this. They keep repeating that even after one
says that what one wants is *precisely* to get a reference to the
caller. I can perfectly well understand that power can be mishandled,
but that is no reason to take power away when there is no other
alternative. If the fear of having javascript's features misused could
be invoked to remove features, one would end up pretty fast with no
javascript at all. Almost anything can be misused, and I see better
candidates for exclusion.

Admittedly the mechanism could be improved - beginning with having a
special variable which would refer to the current function itself and
from which all context information could be derived, and if a special
variable doesn't sound good, then by all means a member of the Function
object - something like Function.current, or Function.getCurrent() -
would be welcome. But what is not welcome at all is the menace of
removal of a basic feature of the language with no alternative at all.
Sorry, but just to say that 'caller isn't needed' is the same as calling
the other person stupid. Of course there might be some uses of 'caller'
which could be solved in a different, better way. Not all of them,
though, and what is gained by removing it other than ego-rubbing?
I should point out that 'goto' (as if it were a comparable case!) has
alternatives. There is nothing you can do with it that you can't do
without. Not so here.

Could anyone explain this to me?
Cheers,
Antonio




--
Posted via a free Usenet account from http://www.teranews.com

[Thomas 'PointedEars' Lahn]

António Marques wrote:

I've seen people I respect swear by their lives that it is *good* to have
it [the caller property] deprecated. 'Because there are better ways of
doing what you want'. I can't understand this.

ISTM that the statement becomes more understandable when considering the
context in which it was given, that you have not told about. IOW: *What*
is it exactly that you want?

They keep repeating that even after one says that what one wants is
*precisely* to get a reference to the caller.

But *why* do you want that?

I can perfectly well understand that power can be mishandled, but that is
no reason to take power away when there is no other alternative.

I wonder what you think the power would be. With a caller property or a
reference passed as an argument, you will only get a reference to a Function
object (or `null'). You cannot know, without much effort in manually
bookkeeping object references, what that Function object is a method of,
nor, to make matters even more complicated, as the method of which object
it was called.

If the fear of having javascript's features misused could be invoked to
remove features, one would end up pretty fast with no javascript at all.

I don't think possible misuse was the reasoning for the decision, but rather
deemed uselessness and observed missing universal implementation, as
demonstrated by your stating that Opera's script engine lacking it. It
would be reasonable to exclude such a feature from the Specification, as
section 2 of the Specification allows implementations to support properties
that were not specified (among other things). The decision of the
implementors to deprecate that property is an entirely different matter --
why don't you ask *them* about it?

Admittedly the mechanism could be improved - beginning with having a
special variable which would refer to the current function itself

You mean the standardized arguments.callee property?

and from which all context information could be derived,

It would seem that this information is somehow exposed internally, otherwise
Venkman and Firebug could not provide it.

[...] Sorry, but just to say that 'caller isn't needed' is the same as
calling the other person stupid. [rant]

Name at least one example where you deem a caller property to be required
and we can discuss it then. Anything else is just a waste of time.
PointedEars
--
Prototype.js was written by people who don't know javascript for people
who don't know javascript. People who don't know javascript are not
the best source of advice on designing systems that use javascript.
-- Richard Cornford, cljs, <f8*******************@news.demon.co.uk>

[VK]

On Jan 18, 10:15 pm, António Marques <[e-mail]:

Hi,

Sorry if this's been discussed before, I couldn't find it.
As well you know, the ECMAScript standard doesn't include any way to
access a function's caller. This has been available on Mozilla and IE as
a 'caller' property of function objects, and it seems Konqueror/Safari
now have it too. Opera doesn't. And what bothers me is that it is marked
as 'deprecated'.

There are caller[1] (of function), caller[2] (of current instance) and
__caller__ (Netscape proprietary for caller[2]

caller[2] and __caller__ are potentially dangerous as opening a way to
get into execution stack within default security. This way they were
either patched for functionality decrease or removed. caller[1] is
secure but just went under the same security campaign by mistake.

Following is a Brendan Eich comment on Mozilla 0.9 (2001-01-10):

"All traces of a caller property were removed a while ago,
to follow ECMA-262 and to avoid any chance of a security exploit.
The removal seems to me to have been overzealous, because it axed
the caller property of function objects *and* the
much-more-exploitable caller (or __caller__) property of
activation objects.

"Confirming, we should consider restoring the caller property
of function objects for old time's sake (JScript imitated it
faithfully in cloning JS1.1, where it originated)."

See also in depth discussion on the topic at
"Recursive functions and arguments.callee.caller"
http://groups.google.com/group/comp....fd9c1a17c21ca5

[Csaba Gabor]

You may find the following thread on caller, callee interesting:

http://groups.google.com/group/comp....d9c1a17c21ca5/

Also, I logged a bug report at:
https://bugzilla.mozilla.org/show_bug.cgi?id=332104

Csaba Gabor from Vienna

On Jan 18, 8:15 pm, António Marques <[e-mail]:

Hi,

Sorry if this's been discussed before, I couldn't find it.
As well you know, the ECMAScript standard doesn't include any way to
access a function's caller. This has been available on Mozilla and IE as
a 'caller' property of function objects, and it seems Konqueror/Safari
now have it too. Opera doesn't. And what bothers me is that it is marked
as 'deprecated'.

I've seen people I respect swear by their lives that it is *good* to
have it deprecated. 'Because there are better ways of doing what you
want'. I can't understand this. They keep repeating that even after one
says that what one wants is *precisely* to get a reference to the
caller. I can perfectly well understand that power can be mishandled,
but that is no reason to take power away when there is no other
alternative. If the fear of having javascript's features misused could
be invoked to remove features, one would end up pretty fast with no
javascript at all. Almost anything can be misused, and I see better
candidates for exclusion.

Admittedly the mechanism could be improved - beginning with having a
special variable which would refer to the current function itself and
from which all context information could be derived, and if a special
variable doesn't sound good, then by all means a member of the Function
object - something like Function.current, or Function.getCurrent() -
would be welcome. But what is not welcome at all is the menace of
removal of a basic feature of the language with no alternative at all.
Sorry, but just to say that 'caller isn't needed' is the same as calling
the other person stupid. Of course there might be some uses of 'caller'
which could be solved in a different, better way. Not all of them,
though, and what is gained by removing it other than ego-rubbing?
I should point out that 'goto' (as if it were a comparable case!) has
alternatives. There is nothing you can do with it that you can't do
without. Not so here.

Could anyone explain this to me?
Cheers,
Antonio

[John G Harris]

On Fri, 18 Jan 2008 at 19:15:40, in comp.lang.javascript, António
Marques wrote:

>Hi,

Sorry if this's been discussed before, I couldn't find it.
As well you know, the ECMAScript standard doesn't include any way to
access a function's caller. This has been available on Mozilla and IE as
a 'caller' property of function objects, and it seems Konqueror/Safari
now have it too. Opera doesn't. And what bothers me is that it is marked
as 'deprecated'.

<snip>

This problem appeared in the early days of computing. Sometimes the code
in a function needs to know something. The solution was ingenious. The
caller supplies 'arguments' that tell the function what it needs to
know. Clever, eh?

John
--
John Harris

[=?ISO-8859-1?Q?Ant=F3nio_Marques?=]

John G Harris wrote:

>Sorry if this's been discussed before, I couldn't find it. As well
you know, the ECMAScript standard doesn't include any way to access
a function's caller. This has been available on Mozilla and IE as
a 'caller' property of function objects, and it seems
Konqueror/Safari now have it too. Opera doesn't. And what bothers
me is that it is marked as 'deprecated'.

<snip>

This problem appeared in the early days of computing. Sometimes the
code in a function needs to know something. The solution was
ingenious. The caller supplies 'arguments' that tell the function
what it needs to know. Clever, eh?

My fault, I apologise. I forgot to ask for intelligent opinions only.

--
Posted via a free Usenet account from http://www.teranews.com

[=?ISO-8859-1?Q?Ant=F3nio_Marques?=]

Csaba Gabor wrote:

You may find the following thread on caller, callee interesting:

http://groups.google.com/group/comp....d9c1a17c21ca5/

Also, I logged a bug report at:
https://bugzilla.mozilla.org/show_bug.cgi?id=332104

Well, they do say ->

The good news is that ECMA TG1 is busy working on Edition 4, and part
of that (still not a done deal) is stack reflection.

-which is quite interesting. Does anyone have any more info on that?

Thanks,
Antonio

--
Posted via a free Usenet account from http://www.teranews.com

[=?ISO-8859-1?Q?Ant=F3nio_Marques?=]

VK wrote:

>As well you know, the ECMAScript standard doesn't include any way
to access a function's caller. This has been available on Mozilla
and IE as a 'caller' property of function objects, and it seems
Konqueror/Safari now have it too. Opera doesn't. And what bothers
me is that it is marked as 'deprecated'.

There are caller[1] (of function), caller[2] (of current instance)
and __caller__ (Netscape proprietary for caller[2]

caller[2] and __caller__ are potentially dangerous as opening a way
to get into execution stack within default security. This way they
were either patched for functionality decrease or removed.

Even if I was refering to caller[1] (''caller' property of function
objects'), I'd be interested in knowing what was so dangerous about
granting access to the activation object in itself anyway that the whole
object had to be locked out.

caller[1] is secure but just went under the same security campaign by
mistake.

Following is a Brendan Eich comment on Mozilla 0.9 (2001-01-10):

"All traces of a caller property were removed a while ago, to follow
ECMA-262 and to avoid any chance of a security exploit. The removal
seems to me to have been overzealous, because it axed the caller
property of function objects *and* the much-more-exploitable caller
(or __caller__) property of activation objects.

"Confirming, we should consider restoring the caller property of
function objects for old time's sake (JScript imitated it faithfully
in cloning JS1.1, where it originated)."

I did endure Netscape 4.72 as my browser since it appeared until Mozilla
reached 1.2 - I think this may have been fixed by then, I don't recall
having had any issues. Certainly Gecko 1.8 has a Function.prototype.caller.

See also in depth discussion on the topic at "Recursive functions and
arguments.callee.caller"
http://groups.google.com/group/comp....wse_frm/thread...

Hey, thanks.

--
Posted via a free Usenet account from http://www.teranews.com