This page is intended to document the properties on JavaScript objects that are used internally by the Caja implementation: what they mean, what invariants are supposed to hold, and what they are relied upon for.
In the table below, x stands for "any object".
| Object | Property | Meaning | Should be set iff | Written by | Read by |
| Object, Array | typeTag___ | name of the built-in type | always | caja.js:38-39 | isJSONContainer() uses this to check whether an object's direct constructor is Object or Array. copy() and each() use this to decide whether the given object is an Array. |
| x | name_getter___ | method for handling get-faults on x[name] | ? | useGetHandler() | handleRead___ |
| x | name_handler___ | method for handling call-faults on x[name]() | ? | useApplyHandler() | handleCall___ |
| x | name_setter___ | method for handling set-faults on x[name] = value | ? | useSetHandler() | handleSet___ |
| x | name_deleter___ | method for handling delete-faults on delete x[name] | ? | useSetHandler() | handleDelete___ |
| x | __proto__ | if present, the object that x directly inherits from | running Firefox, or directConstructor() has ever been called on x | directConstructor() uses this as a cache | directConstructor() |
| x | __FROZEN__ | if present as an own (a non-inherited) property of x, x is considered frozen. A frozen object must not contain any settable or deletable properties. All prototypical objects must be frozen. All functions must be frozen before their first call. | ? | primFreeze() | isFrozen() |
| x | name_canRead___ | if truthy, x.name can be read directly. If x.name is an unattached method, x.name_canRead___ must not be truthy, since an attempt to read x.name must return instead this method as attached to x | ? | fastpathRead() | canRead() |