poe-code 14.0.64 → 14.0.66

package/packages/safe-js/dist/interp/methods/function.d.ts

@@ -2,6 +2,6 @@ import { type SandboxClosure, type SandboxValue } from "../values.js";
 import type { Budget } from "../budget.js";
 export type FunctionMethodOptions = {
     budget?: Budget;
-    callClosure: (closure: SandboxClosure, args: readonly SandboxValue[], stack: readonly string[], thisValue: SandboxValue, construct?: boolean) => Promise<SandboxValue> | SandboxValue;
+    callClosure: (closure: SandboxClosure, args: readonly SandboxValue[], stack: readonly string[], thisValue: SandboxValue, construct?: boolean, newTarget?: SandboxClosure) => Promise<SandboxValue> | SandboxValue;
 };
 export declare function getFunctionMember(target: SandboxClosure, property: string | number, options: FunctionMethodOptions): SandboxValue | undefined;

package/packages/safe-js/dist/interp/methods/function.js

@@ -41,13 +41,13 @@ export function getFunctionMember(target, property, options) {
         sandbox: true,
         name: `Function#${property}`,
         ...(property === "toString" ? { length: 0 } : {}),
-        call: (args, context) => callFunctionMethod(context?.thisValue, property, args, options, context?.stack ?? [])
+        call: (args, context) => callFunctionMethod(context?.thisValue, property, args, options, context?.stack ?? [], context)
     });
 }
 function isFunctionMethodName(property) {
     return typeof property === "string" && functionMethodNames.has(property);
 }
-function callFunctionMethod(target, methodName, args, options, stack) {
+function callFunctionMethod(target, methodName, args, options, stack, context) {
     if (!isSandboxClosure(target)) {
         throw new TypeError(`Function#${methodName} requires a callable receiver.`);
     }
@@ -58,23 +58,41 @@ function callFunctionMethod(target, methodName, args, options, stack) {
     const thisValue = args[0];
     if (methodName === "bind") {
         const boundArgs = args.slice(1);
-        const bound = createSandboxClosure({
-            guest: true,
-            sandbox: true,
-            name: `bound ${target.name ?? ""}`,
-            length: target.length === undefined ? undefined : Math.max(0, target.length - boundArgs.length),
-            boundTarget: target,
-            retainedValues: () => [target, thisValue, ...boundArgs],
-            call: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], thisValue),
-            ...(target.construct === undefined
-                ? {}
-                : {
-                    construct: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], undefined, true)
-                })
-        });
-        if (hasExplicitSandboxPrototype(target))
-            setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
-        return bound;
+        const bind = (length, name) => {
+            const bound = createSandboxClosure({
+                guest: true,
+                sandbox: true,
+                name: `bound ${name}`,
+                length,
+                boundTarget: target,
+                retainedValues: () => [target, thisValue, ...boundArgs, bound.name],
+                call: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], thisValue),
+                ...(target.construct === undefined
+                    ? {}
+                    : {
+                        construct: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], undefined, true, context?.newTarget === bound ? target : context?.newTarget)
+                    })
+            });
+            if (hasExplicitSandboxPrototype(target))
+                setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+            return bound;
+        };
+        if (context?.getProperty === undefined)
+            return bind(target.length === undefined ? undefined : Math.max(0, target.length - boundArgs.length), target.name ?? "");
+        return (async () => {
+            const properties = target.properties;
+            const defaultName = target.name;
+            const hasLength = !isGuestClosure(target) ||
+                target.properties === undefined ||
+                Object.hasOwn(target.properties, "length");
+            const length = hasLength ? await context.getProperty(target, "length") : undefined;
+            const name = !isGuestClosure(target) && !Object.hasOwn(properties ?? {}, "name")
+                ? defaultName
+                : await context.getProperty(target, "name");
+            return bind(typeof length === "number" && !Number.isNaN(length)
+                ? Math.max(0, Math.trunc(length) - boundArgs.length)
+                : 0, typeof name === "string" ? name : "");
+        })();
     }
     if (methodName === "call") {
         return options.callClosure(target, args.slice(1), stack, thisValue);
@@ -86,5 +104,23 @@ function callFunctionMethod(target, methodName, args, options, stack) {
     if (!Array.isArray(applyArgs)) {
         throw new TypeError("Function#apply requires an array or nullish arguments value.");
     }
-    return options.callClosure(target, applyArgs, stack, thisValue);
+    if (context?.getProperty === undefined)
+        return options.callClosure(target, applyArgs, stack, thisValue);
+    return (async () => {
+        const values = [];
+        const length = applyArgs.length;
+        options.budget?.allocateArrayLength(length);
+        const retained = {};
+        options.budget?.setRetainedValues(retained, () => values);
+        try {
+            for (let index = 0; index < length; index++) {
+                options.budget?.visitNode();
+                values.push(await context.getProperty(applyArgs, index));
+            }
+            return await options.callClosure(target, values, stack, thisValue);
+        }
+        finally {
+            options.budget?.setRetainedValues(retained, undefined);
+        }
+    })();
 }

package/packages/safe-js/dist/interp/methods/regex.js

@@ -84,7 +84,7 @@ export async function callRegexMethod(target, methodName, args, budget, context)
         const input = await sandboxString(args[0], budget, context);
         if (methodName === "test") {
             const exec = context?.getProperty === undefined
-                ? getSandboxDataProperty(target, "exec", budget) : context.getProperty(target, "exec");
+                ? getSandboxDataProperty(target, "exec", budget) : await context.getProperty(target, "exec");
             if (isSandboxClosure(exec)) {
                 const result = await invokeBuiltinClosure(exec, [input], budget, context, target);
                 if (result !== null && typeof result !== "object") {

package/packages/safe-js/dist/interp/object-model.d.ts

@@ -14,6 +14,7 @@ export declare function isIntrinsicConstructor(value: object): boolean;
 export declare function releaseObjectPrototype(budget: Budget): void;
 export declare function getSandboxPrototype(value: object, budget?: Budget): object | null;
 export declare function hasExplicitSandboxPrototype(value: object): boolean;
+export declare function getSandboxPropertyDescriptor(value: SandboxValue, key: string | number, budget?: Budget): PropertyDescriptor | undefined;
 export declare function getSandboxDataProperty(value: SandboxValue, key: string | number, budget?: Budget): SandboxValue;
 export declare function setSandboxPrototype(value: object, prototype: object | null, budget?: Budget): void;
 export declare function markDescriptorObject(value: object): void;

package/packages/safe-js/dist/interp/object-model.js

@@ -1,4 +1,5 @@
 import { assertSandboxDataDepth } from "../graph-depth.js";
+import { retainedAccessorClosures } from "./accessors.js";
 import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "./values.js";
@@ -89,27 +90,41 @@ export function isIntrinsicConstructor(value) {
 function registerIntrinsicPrototype(budget, prototype, constructor) {
     let roots = intrinsicPrototypeRoots.get(budget);
     if (roots === undefined)
-        intrinsicPrototypeRoots.set(budget, roots = new Set());
+        intrinsicPrototypeRoots.set(budget, (roots = new Set()));
     roots.add(prototype);
-    const records = [prototype, constructor].map(target => ({
+    const records = [prototype, constructor]
+        .map((target) => ({
         target,
         value: isGuestClosure(target) ? materializeFunctionProperties(target) : target,
         prototype: getSandboxPrototype(target),
         explicit: hasExplicitSandboxPrototype(target)
-    })).map(record => ({
-        ...record, descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record.value)))
+    }))
+        .map((record) => ({
+        ...record,
+        descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record.value)))
     }));
-    const unchanged = (before, after) => before !== undefined && after !== undefined && Object.is(before.value, after.value) &&
-        before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+    const unchanged = (before, after) => before !== undefined &&
+        after !== undefined &&
+        Object.is(before.value, after.value) &&
+        before.get === after.get &&
+        before.set === after.set &&
+        before.writable === after.writable &&
+        before.configurable === after.configurable &&
+        before.enumerable === after.enumerable;
     intrinsicConstructors.set(constructor, () => records.every(({ target, value, descriptors, prototype: parent, explicit }) => {
         const current = Object.getOwnPropertyDescriptors(value);
-        return getSandboxPrototype(target) === parent && hasExplicitSandboxPrototype(target) === explicit &&
+        return (getSandboxPrototype(target) === parent &&
+            hasExplicitSandboxPrototype(target) === explicit &&
             Object.keys(current).length === descriptors.size &&
-            Object.keys(current).every(key => unchanged(descriptors.get(key), current[key]));
+            Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key])));
     }));
     budget.setRetainedValues(prototype, () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
-        ...(getSandboxPrototype(target) === parent ? [] : [getSandboxPrototype(target)]),
-        ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])
+        ...(getSandboxPrototype(target) === parent
+            ? []
+            : [getSandboxPrototype(target)]),
+        ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor)
+            ? []
+            : [key, descriptor.value, ...retainedAccessorClosures(descriptor)])
     ]));
 }
 export function releaseObjectPrototype(budget) {
@@ -134,6 +149,29 @@ export function getSandboxPrototype(value, budget) {
 export function hasExplicitSandboxPrototype(value) {
     return prototypes.has(value);
 }
+export function getSandboxPropertyDescriptor(value, key, budget) {
+    const hostProperties = isSandboxClosure(value) ? value.properties : undefined;
+    if (isSandboxClosure(value) && !isGuestClosure(value))
+        return hostProperties === undefined
+            ? undefined
+            : Object.getOwnPropertyDescriptor(hostProperties, key);
+    let current = value;
+    let depth = 0;
+    while (typeof current === "object" &&
+        current !== null &&
+        (Array.isArray(current) || isPrototypeRecord(current))) {
+        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current) : current;
+        const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
+        if (descriptor !== undefined)
+            return descriptor;
+        current = getSandboxPrototype(current, budget);
+        if (current !== null) {
+            budget?.visitNode();
+            assertSandboxDataDepth(++depth);
+        }
+    }
+    return undefined;
+}
 export function getSandboxDataProperty(value, key, budget) {
     let current = value;
     let depth = 0;

package/packages/safe-js/dist/interp/patterns.d.ts

@@ -12,10 +12,10 @@ export type PatternTarget = {
 };
 export type PatternContext = {
     budget?: Budget;
-    evaluate(node: ParseResult): Promise<AsyncEvaluationResult>;
+    evaluate(node: ParseResult, inferredName?: string): Promise<AsyncEvaluationResult>;
     toPropertyKey(value: SandboxValue): Promise<string>;
-    getProperty(value: SandboxValue, key: string | number): SandboxValue;
-    setProperty(target: SandboxValue, key: string | number, value: SandboxValue): void;
+    getProperty(value: SandboxValue, key: string | number): SandboxValue | Promise<SandboxValue>;
+    setProperty(target: SandboxValue, key: string | number, value: SandboxValue): void | Promise<void>;
 };
 export type BindPatternResult = {
     ok: true;

package/packages/safe-js/dist/interp/patterns.js

@@ -1,5 +1,7 @@
+import { retainValues } from "./resources.js";
+import { hasOwnSandboxProperty } from "./globals/object.js";
 import { isSandboxCollectionIterator, nextCollectionIterator } from "./collection-iterator.js";
-import { isSandboxMap, isSandboxSet, ownEnumerableSandboxEntries } from "./values.js";
+import { isSandboxMap, isSandboxSet, ownEnumerableSandboxKeys } from "./values.js";
 export async function bindPattern(pattern, value, target, scope, context) {
     switch (pattern.type) {
         case "Identifier":
@@ -40,7 +42,7 @@ async function bindAssignmentPattern(pattern, value, target, scope, context) {
     if (value !== undefined) {
         return bindPattern(pattern.left, value, target, scope, context);
     }
-    const defaultValue = await context.evaluate(pattern.right);
+    const defaultValue = await context.evaluate(pattern.right, pattern.left.type === "Identifier" ? pattern.left.name : undefined);
     if (defaultValue.kind !== "normal") {
         return { ok: false, result: defaultValue };
     }
@@ -49,27 +51,34 @@ async function bindAssignmentPattern(pattern, value, target, scope, context) {
 async function bindArrayPattern(pattern, value, target, scope, context) {
     const iterator = isSandboxCollectionIterator(value) ? value : undefined;
     const values = iterator === undefined ? getArrayPatternValues(value) : undefined;
+    let cursor = 0;
+    let done = false;
+    const next = async () => {
+        if (iterator !== undefined)
+            return nextCollectionIterator(iterator, context.budget);
+        if (done || cursor >= values.length) {
+            done = true;
+            return { done: true, value: undefined };
+        }
+        return { done: false, value: await context.getProperty(values, cursor++) };
+    };
     for (let index = 0; index < pattern.elements.length; index += 1) {
         const element = pattern.elements[index];
         if (element === null) {
-            if (iterator !== undefined)
-                nextCollectionIterator(iterator, context.budget);
+            await next();
             continue;
         }
         let elementValue;
-        if (iterator === undefined) {
-            elementValue = element.type === "RestElement" ? values.slice(index) : values[index];
-        }
-        else if (element.type === "RestElement") {
+        if (element.type === "RestElement") {
             const rest = [];
-            for (let entry = nextCollectionIterator(iterator, context.budget); !entry.done; entry = nextCollectionIterator(iterator, context.budget)) {
+            for (let entry = await next(); !entry.done; entry = await next()) {
                 context.budget?.allocateArrayLength(rest.length + 1);
                 rest.push(entry.value);
             }
             elementValue = rest;
         }
         else {
-            elementValue = nextCollectionIterator(iterator, context.budget).value;
+            elementValue = (await next()).value;
         }
         const binding = await bindPattern(element, elementValue, target, scope, context);
         if (!binding.ok) {
@@ -85,7 +94,7 @@ async function bindObjectPattern(pattern, value, target, scope, context) {
     const excludedKeys = new Set();
     for (const property of pattern.properties) {
         if (property.type === "RestElement") {
-            const binding = await bindPattern(property, copyObjectRestValue(value, excludedKeys), target, scope, context);
+            const binding = await bindPattern(property, await copyObjectRestValue(value, excludedKeys, context), target, scope, context);
             if (!binding.ok) {
                 return binding;
             }
@@ -96,7 +105,7 @@ async function bindObjectPattern(pattern, value, target, scope, context) {
             return key;
         }
         excludedKeys.add(String(key.value));
-        const binding = await bindPattern(property.value, context.getProperty(value, key.value), target, scope, context);
+        const binding = await bindPattern(property.value, await context.getProperty(value, key.value), target, scope, context);
         if (!binding.ok) {
             return binding;
         }
@@ -120,7 +129,7 @@ async function bindMemberExpression(pattern, value, scope, context) {
     if (!isIndexableValue(object.value)) {
         throw new TypeError("Assignment expressions require a sandbox object property.");
     }
-    context.setProperty(object.value, await context.toPropertyKey(property.value), value);
+    await context.setProperty(object.value, await context.toPropertyKey(property.value), value);
     return { ok: true };
 }
 async function evaluatePatternKey(property, context) {
@@ -177,12 +186,22 @@ function describeRuntimeValue(value) {
         return value.constructor?.name ?? "Object";
     return typeof value;
 }
-function copyObjectRestValue(value, excludedKeys) {
+async function copyObjectRestValue(value, excludedKeys, context) {
     const rest = Object.create(null);
-    for (const [key, entryValue] of ownEnumerableSandboxEntries(value, excludedKeys)) {
-        defineProperty(rest, key, entryValue);
+    const release = context.budget === undefined
+        ? () => undefined
+        : retainValues(context.budget, () => [value, rest]);
+    try {
+        for (const key of ownEnumerableSandboxKeys(value)) {
+            if (excludedKeys.has(key) || !hasOwnSandboxProperty(value, key, true))
+                continue;
+            defineProperty(rest, key, await context.getProperty(value, key));
+        }
+        return rest;
+    }
+    finally {
+        release();
     }
-    return rest;
 }
 function isIndexableValue(value) {
     return typeof value === "object" && value !== null;

package/packages/safe-js/dist/interp/promise.d.ts

@@ -13,4 +13,4 @@ export declare function resolveSandboxValue(value: SandboxValue | Promise<Sandbo
     self?: SandboxPromise;
 }): Promise<SandboxValue>;
 export declare function consumeSettledHostCall(value: SandboxPromise): undefined;
-export declare function getThenable(value: SandboxValue): SandboxClosure | undefined;
+export declare function requiresPromiseResolution(value: SandboxValue, budget?: Budget): boolean;

package/packages/safe-js/dist/interp/promise.js

@@ -1,4 +1,6 @@
 import { SandboxError } from "./budget.js";
+import { accessorClosure } from "./accessors.js";
+import { getSandboxPropertyDescriptor } from "./object-model.js";
 import { coerceThrownValue, createSubsetErrorValue } from "./exceptions.js";
 import { getSandboxIterator } from "./iteration.js";
 import { retainValues } from "./resources.js";
@@ -197,7 +199,7 @@ async function callPromiseClosure(callback, args, thisValue, budget, context) {
         const values = args.map((value) => value instanceof Error && !(value instanceof SandboxError)
             ? coerceThrownValue(value, budget, stack)
             : value);
-        let result = callback.call(values, { stack, thisValue });
+        let result = callback.call(values, { ...context, stack, thisValue, newTarget: undefined });
         if (callback.async !== true)
             result = await result;
         else if (isPromiseLike(result))
@@ -226,10 +228,10 @@ function getPromisePrototype(budget) {
                 observeSandboxPromise(target);
                 const chained = createSandboxPromise(target.promise.then((value) => {
                     consumeSettledHostCall(target);
-                    return runPromiseReaction(onFulfilled, value, "fulfilled", budget, chained);
+                    return runPromiseReaction(onFulfilled, value, "fulfilled", budget, chained, context);
                 }, (reason) => {
                     consumeSettledHostCall(target);
-                    return runPromiseReaction(onRejected, reason, "rejected", budget, chained);
+                    return runPromiseReaction(onRejected, reason, "rejected", budget, chained, context);
                 }));
                 return chained;
             },
@@ -239,13 +241,18 @@ function getPromisePrototype(budget) {
             sandbox: true,
             call: ([onRejected], context) => {
                 const target = context?.thisValue;
-                const then = readPromiseReceiverProperty(target, "then", prototype);
-                if (!isSandboxClosure(then))
-                    throw new TypeError("Promise.catch requires a callable then.");
-                return then.call([undefined, onRejected], {
-                    stack: context?.stack ?? [],
-                    thisValue: target
-                });
+                const invoke = (then) => {
+                    if (!isSandboxClosure(then))
+                        throw new TypeError("Promise.catch requires a callable then.");
+                    return then.call([undefined, onRejected], {
+                        ...context,
+                        stack: context?.stack ?? [],
+                        thisValue: target,
+                        newTarget: undefined
+                    });
+                };
+                const then = readPromiseReceiverProperty(target, "then", prototype, context);
+                return then instanceof Promise ? then.then(invoke) : invoke(then);
             },
             name: "catch"
         }),
@@ -256,39 +263,50 @@ function getPromisePrototype(budget) {
                 if (typeof target !== "object" || target === null) {
                     throw new TypeError("Promise.finally requires an object receiver.");
                 }
-                validatePromiseConstructorProperty(target, prototype);
-                const then = readPromiseReceiverProperty(target, "then", prototype);
-                if (!isSandboxClosure(then))
-                    throw new TypeError("Promise.finally requires a callable then.");
-                const handlers = isSandboxClosure(onFinally)
-                    ? ["fulfilled", "rejected"].map((state) => createSandboxClosure({
-                        sandbox: true,
-                        retainedValues: () => [onFinally],
-                        call: async ([value]) => {
-                            const result = await callPromiseClosure(onFinally, [], undefined, budget, context);
-                            const pending = isSandboxPromise(result) &&
-                                getPromiseMember("constructor", budget) ===
-                                    intrinsicPromiseConstructors.get(budget)
-                                ? result
-                                : createSandboxPromise(resolveSandboxValue(result, { budget }));
-                            const cleanupThen = getPromiseMember("then", budget);
-                            if (!isSandboxClosure(cleanupThen))
-                                throw new TypeError("Promise cleanup requires a callable then.");
-                            return callPromiseClosure(cleanupThen, [
-                                createSandboxClosure({
-                                    sandbox: true,
-                                    retainedValues: () => [value],
-                                    call: () => {
-                                        if (state === "rejected")
-                                            throw value;
-                                        return value;
-                                    }
-                                })
-                            ], pending, budget, context);
-                        }
-                    }))
-                    : [onFinally, onFinally];
-                return then.call(handlers, { stack: context?.stack ?? [], thisValue: target });
+                const invoke = (then) => {
+                    if (!isSandboxClosure(then))
+                        throw new TypeError("Promise.finally requires a callable then.");
+                    const handlers = isSandboxClosure(onFinally)
+                        ? ["fulfilled", "rejected"].map((state) => createSandboxClosure({
+                            sandbox: true,
+                            retainedValues: () => [onFinally],
+                            call: async ([value]) => {
+                                const result = await callPromiseClosure(onFinally, [], undefined, budget, context);
+                                const pending = isSandboxPromise(result) &&
+                                    getPromiseMember("constructor", budget) ===
+                                        intrinsicPromiseConstructors.get(budget)
+                                    ? result
+                                    : createSandboxPromise(resolveSandboxValue(result, { budget }));
+                                const cleanupThen = getPromiseMember("then", budget);
+                                if (!isSandboxClosure(cleanupThen))
+                                    throw new TypeError("Promise cleanup requires a callable then.");
+                                return callPromiseClosure(cleanupThen, [
+                                    createSandboxClosure({
+                                        sandbox: true,
+                                        retainedValues: () => [value],
+                                        call: () => {
+                                            if (state === "rejected")
+                                                throw value;
+                                            return value;
+                                        }
+                                    })
+                                ], pending, budget, context);
+                            }
+                        }))
+                        : [onFinally, onFinally];
+                    return then.call(handlers, {
+                        ...context,
+                        stack: context?.stack ?? [],
+                        thisValue: target,
+                        newTarget: undefined
+                    });
+                };
+                const finish = () => {
+                    const then = readPromiseReceiverProperty(target, "then", prototype, context);
+                    return then instanceof Promise ? then.then(invoke) : invoke(then);
+                };
+                const validation = validatePromiseConstructorProperty(target, prototype, context);
+                return validation instanceof Promise ? validation.then(finish) : finish();
             },
             name: "finally"
         })
@@ -299,7 +317,9 @@ function getPromisePrototype(budget) {
     promisePrototypes.set(budget, prototype);
     return prototype;
 }
-function readPromiseReceiverProperty(receiver, property, prototype) {
+function readPromiseReceiverProperty(receiver, property, prototype, context) {
+    if (!isSandboxPromise(receiver) && context?.getProperty !== undefined)
+        return context.getProperty(receiver, property);
     const properties = isSandboxPromise(receiver)
         ? prototype
         : isSandboxClosure(receiver)
@@ -311,11 +331,13 @@ function readPromiseReceiverProperty(receiver, property, prototype) {
         ? properties[property]
         : undefined;
 }
-function validatePromiseConstructorProperty(receiver, prototype) {
-    const constructor = readPromiseReceiverProperty(receiver, "constructor", prototype);
-    if (constructor !== undefined && (typeof constructor !== "object" || constructor === null)) {
-        throw new TypeError("Promise constructor property must be an object.");
-    }
+function validatePromiseConstructorProperty(receiver, prototype, context) {
+    const validate = (constructor) => {
+        if (constructor !== undefined && (typeof constructor !== "object" || constructor === null))
+            throw new TypeError("Promise constructor property must be an object.");
+    };
+    const constructor = readPromiseReceiverProperty(receiver, "constructor", prototype, context);
+    return constructor instanceof Promise ? constructor.then(validate) : validate(constructor);
 }
 async function settleIterable(iterable, method, budget, constructor, context) {
     const capability = await createPromiseCapability(constructor, budget, context);
@@ -335,7 +357,7 @@ async function settleIterable(iterable, method, budget, constructor, context) {
         }
     };
     try {
-        const promiseResolve = readPromiseReceiverProperty(constructor, "resolve", prototype);
+        const promiseResolve = await readPromiseReceiverProperty(constructor, "resolve", prototype, context);
         if (!isSandboxClosure(promiseResolve))
             throw new TypeError("Promise constructor requires a callable resolve.");
         const iterator = getSandboxIterator(iterable, budget, context);
@@ -391,7 +413,7 @@ async function settleIterable(iterable, method, budget, constructor, context) {
                         });
                     });
                     remaining++;
-                    const then = readPromiseReceiverProperty(entry, "then", prototype);
+                    const then = await readPromiseReceiverProperty(entry, "then", prototype, context);
                     if (!isSandboxClosure(then))
                         throw new TypeError("Promise resolver result requires a callable then.");
                     await callPromiseClosure(then, handlers, entry, budget, context);
@@ -472,7 +494,11 @@ function resolveSandboxValueNow(value, options) {
             return Promise.reject(budgetIfNeeded(reason, options.budget));
         });
     }
-    const then = getThenable(value);
+    const then = getThenable(value, options.budget);
+    if (then instanceof Promise)
+        return then.then((method) => method === undefined
+            ? budgetIfNeeded(value, options.budget)
+            : resolveThenable(value, method, options));
     if (then !== undefined) {
         return resolveThenable(value, then, options);
     }
@@ -492,7 +518,7 @@ function resolveThenable(value, then, options) {
             completed = true;
             try {
                 if (settlement.state === "fulfilled") {
-                    resolve(isSandboxPromise(settlement.value) || getThenable(settlement.value) !== undefined
+                    resolve(requiresPromiseResolution(settlement.value, options.budget)
                         ? resolveSandboxValueNow(settlement.value, options)
                         : budgetIfNeeded(settlement.value, options.budget));
                 }
@@ -547,7 +573,7 @@ function resolveThenable(value, then, options) {
         }).catch(reject);
     });
 }
-function runPromiseReaction(handler, value, state, budget, self) {
+function runPromiseReaction(handler, value, state, budget, self, context) {
     return new Promise((resolve, reject) => {
         if (state === "rejected" &&
             value instanceof SandboxError &&
@@ -563,7 +589,7 @@ function runPromiseReaction(handler, value, state, budget, self) {
             else if (isSelfResolution(result, self)) {
                 reject(createSubsetErrorValue("TypeError", "Promise cannot resolve to itself.", [], budget));
             }
-            else if (isSandboxPromise(result) || getThenable(result) !== undefined) {
+            else if (requiresPromiseResolution(result, budget)) {
                 resolve(resolvePromiseResult(result, budget, self));
             }
             else {
@@ -571,7 +597,7 @@ function runPromiseReaction(handler, value, state, budget, self) {
             }
         };
         if (isSandboxClosure(handler)) {
-            callInPromiseJob(handler, [argument], undefined, { fulfilled, rejected: reject }).catch(reject);
+            callInPromiseJob(handler, [argument], undefined, { fulfilled, rejected: reject }, context).catch(reject);
         }
         else {
             runPromiseJob(() => {
@@ -583,10 +609,10 @@ function runPromiseReaction(handler, value, state, budget, self) {
         }
     });
 }
-function callInPromiseJob(handler, args, thisValue = undefined, completion) {
+function callInPromiseJob(handler, args, thisValue = undefined, completion, context) {
     return runPromiseJob(async () => {
         try {
-            let result = handler.call(args, { stack: [], thisValue });
+            let result = handler.call(args, { ...context, stack: [], thisValue, newTarget: undefined });
             if (handler.async !== true)
                 result = await result;
             if (isSandboxPromise(result) && result.synchronousPrefix !== undefined) {
@@ -624,7 +650,7 @@ function resolvePromiseResult(result, budget, self) {
             try {
                 if (state === "rejected")
                     reject(budgetSandboxValue(value, budget));
-                else if (isSandboxPromise(value) || getThenable(value) !== undefined) {
+                else if (requiresPromiseResolution(value, budget)) {
                     resolve(resolvePromiseResult(value, budget, self));
                 }
                 else {
@@ -672,13 +698,27 @@ function isSelfResolution(result, self) {
     return (self !== undefined &&
         (result === self || (isSandboxPromise(result) && result.promise === self.promise)));
 }
-export function getThenable(value) {
+export function requiresPromiseResolution(value, budget) {
+    if (isSandboxPromise(value))
+        return true;
+    const descriptor = getSandboxPropertyDescriptor(value, "then", budget);
+    return (descriptor !== undefined && (!("value" in descriptor) || isSandboxClosure(descriptor.value)));
+}
+function getThenable(value, budget) {
     if (typeof value !== "object" || value === null || isSandboxPromise(value)) {
         return undefined;
     }
-    const then = isSandboxClosure(value)
-        ? value.properties?.then
-        : value.then;
+    const descriptor = getSandboxPropertyDescriptor(value, "then", budget);
+    if (descriptor !== undefined && !("value" in descriptor)) {
+        const getter = accessorClosure(descriptor.get);
+        if (getter === undefined)
+            return undefined;
+        const result = budget === undefined
+            ? getter.call([], { stack: [], thisValue: value })
+            : callPromiseClosure(getter, [], value, budget);
+        return Promise.resolve(result).then((then) => (isSandboxClosure(then) ? then : undefined));
+    }
+    const then = descriptor?.value;
     return isSandboxClosure(then) ? then : undefined;
 }
 function budgetIfNeeded(value, budget) {