AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Check global object behind global proxy for extensibility

Browse Source 
BUG=454091
LOG=Y

Review URL: https://codereview.chromium.org/895573002

Cr-Commit-Position: refs/heads/master@{#26380}
This commit is contained in:
verwaest 2015-02-02 04:49:00 -08:00 committed by Commit bot
parent 81c4a42221
commit 1de7dff2ef
3 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/accessors.cc
View File

@ -136,6 +136,12 @@ bool SetPropertyOnInstanceIfInherited(
// This behaves sloppy since we lost the actual strict-mode.
// TODO(verwaest): Fix by making ExecutableAccessorInfo behave like data
// properties.
if (object->IsJSGlobalProxy()) {
PrototypeIterator iter(isolate, object);
if (iter.IsAtEnd()) return true;
DCHECK(PrototypeIterator::GetCurrent(iter)->IsJSGlobalObject());
object = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
}
if (!object->map()->is_extensible()) return true;
JSObject::SetOwnPropertyIgnoreAttributes(object, Utils::OpenHandle(*name),
value, NONE).Check();

7
src/objects.cc
View File

@ -12115,6 +12115,13 @@ MaybeHandle<Object> JSObject::SetPrototype(Handle<JSObject> object,
real_receiver =
Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
iter.Advance();
if (!real_receiver->map()->is_extensible()) {
Handle<Object> args[] = {object};
THROW_NEW_ERROR(isolate,
NewTypeError("non_extensible_proto",
HandleVector(args, arraysize(args))),
Object);
}
}
}

9
test/mjsunit/regress/regress-crbug-454091.js Normal file
View File

@ -0,0 +1,9 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
this.__proto__ = Array.prototype;
Object.freeze(this);
this.length = 1;
assertThrows('this.__proto__ = {}');
assertEquals(Array.prototype, this.__proto__);