Changeset 92618 in webkit

Timestamp:

Aug 8, 2011 12:09:51 PM (13 years ago)

Author:

oliver@apple.com

Message:

Non-extensibility does not prevent mutating Prototype?
​https://bugs.webkit.org/show_bug.cgi?id=65832

Reviewed by Gavin Barraclough.

../../../../Volumes/Data/git/WebKit/OpenSource/LayoutTests:

Add tests to ensure we can't assign to proto when an object
is not extensible.

• fast/js/preventExtensions-expected.txt:
• fast/js/script-tests/preventExtensions.js:

../../../../Volumes/Data/git/WebKit/OpenSource/Source/JavaScriptCore:

Disallow mutation of proto on objects that are not extensible.

• runtime/JSObject.cpp:

(JSC::JSObject::put):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/preventExtensions-expected.txt (modified) (1 diff)
• LayoutTests/fast/js/script-tests/preventExtensions.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Non-extensibility does not prevent mutating [[Prototype]]
+        https://bugs.webkit.org/show_bug.cgi?id=65832
+
+        Reviewed by Gavin Barraclough.
+
+        Add tests to ensure we can't assign to __proto__ when an object
+        is not extensible.
+
+        * fast/js/preventExtensions-expected.txt:
+        * fast/js/script-tests/preventExtensions.js:
+
 2011-08-08  Jian Li  <jianli@chromium.org>
 

trunk/LayoutTests/fast/js/preventExtensions-expected.txt

@@ -12 +12 @@
 PASS test(freeze(obj())) is "(a:1)(b:2)SF"
 PASS Object.preventExtensions(Math.sin) is Math.sin
+PASS var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; o.newProp; is undefined.
+PASS "use strict"; var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; threw exception TypeError: Attempted to assign to readonly property..
 PASS successfullyParsed is true
 

trunk/LayoutTests/fast/js/script-tests/preventExtensions.js

@@ -69 +69 @@
 shouldBe('Object.preventExtensions(Math.sin)', 'Math.sin');
 
+shouldBeUndefined('var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; o.newProp;');
+shouldThrow('"use strict"; var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" };');
+
 successfullyParsed = true;

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Non-extensibility does not prevent mutating [[Prototype]]
+        https://bugs.webkit.org/show_bug.cgi?id=65832
+
+        Reviewed by Gavin Barraclough.
+
+        Disallow mutation of __proto__ on objects that are not extensible.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+
 2011-08-08  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -111 +111 @@
         if (!value.isObject() && !value.isNull())
             return;
+
+        if (!isExtensible()) {
+            if (slot.isStrictMode())
+                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            return;
+        }
+            
         if (!setPrototypeWithCycleCheck(exec->globalData(), value))
             throwError(exec, createError(exec, "cyclic __proto__ value"));