Symbol.toPrimitive passed to Proxy as property name even when Symbol builtin is not enabled

In Frida we have a Proxy like this:

        const self = new Proxy(this, {
            has(target, property) {
                return hasProperty(property);
            },
            get(target, property, receiver) {
                switch (property) {
                    case "handle":
                        return handle;
                    case "prototype":
                        return target.prototype;
                    case "constructor":
                        return target.constructor;
                    case "hasOwnProperty":
                        return hasProperty;
                    case "toJSON":
                        return toJSON;
                    case "toString":
                    case "valueOf":
                        const descriptionImpl = receiver.description;
                        if (descriptionImpl !== undefined) {
                            const description = descriptionImpl.call(receiver);
                            if (description !== null)
                                return description.UTF8String.bind(description);
                        }
                        return function () {
                            return receiver.$className;
                        };
...

Apparently, in the latest version of duktape the property argument of get() can be a Symbol. In particular when coercing this object to a string, the "toString" property turned into a Symbol.toPrimitive.

The problem is that if we don’t enable the DUK_USE_SYMBOL_BUILTIN configuration, there’s no way to properly compare the property and get to the right case. This is also complicated by the fact we’re using core-js polyfills which have their Symbol implementation which doesn’t help in this case.

This can be solved by enabling DUK_USE_SYMBOL_BUILTIN and just adding case Symbol.toPrimitive: in the switch, but if i understand correctly that’s still experimental.

Maybe i’m wrong but i expected that when Symbol builtins are not there, the property here should be a string as it was before?

[svaarala]

Internal Symbol support cannot be fully turned off because at least the internal hidden Symbol properties are needed (Duktape uses them internally). In this case it may be that even without the Symbol built-in a @@toPrimitive lookup is done.

[mrmacete]

@fatcerberus nope, enabling Symbol built-in just made it possible to handle the case