Changeset 95011 in webkit

Timestamp:

Sep 12, 2011 9:01:59 PM (13 years ago)

Author:

weinig@apple.com

Message:

Don't allow setting proto to be a getter or setter
​https://bugs.webkit.org/show_bug.cgi?id=67982

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

• runtime/JSObject.cpp:

(JSC::JSObject::defineGetter):
(JSC::JSObject::defineSetter):
Disallow setting a getter or setter on proto.

LayoutTests:

• fast/js/prototypes-expected.txt:
• fast/js/script-tests/prototypes.js:

Add test that we disallow setting a getter or setter on proto.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/prototypes-expected.txt (modified) (1 diff)
• LayoutTests/fast/js/script-tests/prototypes.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-09-12  Sam Weinig  <sam@webkit.org>
+
+        Don't allow setting __proto__ to be a getter or setter
+        https://bugs.webkit.org/show_bug.cgi?id=67982
+
+        Reviewed by Gavin Barraclough.
+
+        * fast/js/prototypes-expected.txt:
+        * fast/js/script-tests/prototypes.js:
+        Add test that we disallow setting a getter or setter on __proto__.
+
 2011-09-12  Jacky Jiang  <zhajiang@rim.com>
 

trunk/LayoutTests/fast/js/prototypes-expected.txt

@@ -54 +54 @@
 PASS Object.__proto__.isPrototypeOf(Number) is true
 PASS Object.__proto__.isPrototypeOf(String) is true
+PASS var wasSet = false; var o = { }; o.__defineGetter__("__proto__", function() { wasSet = true }); o.__proto__; wasSet; is false
+PASS var wasSet = false; var o = { }; o.__defineSetter__("__proto__", function() { wasSet = true }); o.__proto__ = {}; wasSet; is false
 PASS successfullyParsed is true
 

trunk/LayoutTests/fast/js/script-tests/prototypes.js

@@ -56 +56 @@
 shouldBeTrue("Object.__proto__.isPrototypeOf(String)");
 
+shouldBeFalse("var wasSet = false; var o = { }; o.__defineGetter__(\"__proto__\", function() { wasSet = true }); o.__proto__; wasSet;");
+shouldBeFalse("var wasSet = false; var o = { }; o.__defineSetter__(\"__proto__\", function() { wasSet = true }); o.__proto__ = {}; wasSet;");
+
 var successfullyParsed = true;

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-12  Sam Weinig  <sam@webkit.org>
+
+        Don't allow setting __proto__ to be a getter or setter
+        https://bugs.webkit.org/show_bug.cgi?id=67982
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        Disallow setting a getter or setter on __proto__.
+
 2011-09-12  James Robinson  <jamesr@chromium.org>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -323 +323 @@
 void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
+    if (propertyName == exec->propertyNames().underscoreProto) {
+        // Defining a getter for __proto__ is silently ignored.
+        return;
+    }
+
     JSValue object = getDirect(exec->globalData(), propertyName);
     if (object && object.isGetterSetter()) {
@@ -349 +354 @@
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
+    if (propertyName == exec->propertyNames().underscoreProto) {
+        // Defining a setter for __proto__ is silently ignored.
+        return;
+    }
+
     JSValue object = getDirect(exec->globalData(), propertyName);
     if (object && object.isGetterSetter()) {