Should tape be resilient against mutating the ES5 environment

[Raynos]

People tend to not mutate the ES5 environment by deleting methods on build in prototypes.

Anyone that does this in production is being silly.

Should tape be defensive against this. I think this is really a 1% case.

cc @ljharb

[ljharb]

My argument is that while an individual module certainly may decide to be robust against builtin modification, or not - tape is supposed to allow any modules to write their tests. The argument that "doing this in production is silly" doesn't erase the fact that it can occur - what seems silly to me is ignoring easily resolved potential problems because we deem them inconsequential.

The subset of modules that does try to be robust against builtin modification needs a way to test that robustness. If tape is not itself robust against this, then there is simply no way for these modules to test themselves cleanly in these scenarios - and they'd be forced to (as described here) write a separate set of tests, with their own homegrown testing code, in order to cover these cases.

In an ES5 world, it's trivial to be robust against this entirely by using .bind - in ES3, it's trivial to do so using the function-bind module. The current approach - caching the native method, and constructing a wrapper to call it using .call - is robust against everything but Function#call modification, which I consider mostly acceptable since if one breaks Function#call, even parts of node core can break.

What I'd like to see come out of this discussion is a clear agreement that we:

• maintain ES3 compatibility
• are robust against environment breakage, not including Function#call
  • OR
• are robust against environment breakage, including Function#call

The only extra dependency we'd need to achieve all three is function-bind - if we don't want that dependency, continuing the current approach of a wrapper function and a cached builtin is just fine with me.

[Raynos]

maintain ES3 compatibility

👍 The whole point of tape was testing in IE6.

[ghost]

This might be a niche case, but it's easy to support using modules like has and function-bind, so I'm in favor. IE6/ES3 is also something of a 1% case at this point too, but it's worth maintaining support.

[Raynos]

@ljharb I buy it;

Feel free to continue reviewing with stability in mind and I'll stop bikeshedding :P

[ljharb]

Awesome, thanks for clarifying :-) I don't mind the discussion at all and I'm glad you brought it up!

I'll make a PR sometime soon that switches to using function-bind, and if that gets 👍 then the pattern will be there in the codebase for others to follow.