AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Allow global prototype to be a Proxy

Browse Source 
There was a security issue from allowing WindowProxy to have its prototype mutated in https://bugs.chromium.org/p/chromium/issues/detail?id=399951 . This has since been resolved by making `window`, `location`, and `Object.prototype.__proto__` immutable. This change was fixed in https://bugs.chromium.org/p/v8/issues/detail?id=5149 .

Reverts https://codereview.chromium.org/1529303003

R=littledan@chromium.org
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2671553006
Cr-Commit-Position: refs/heads/master@{#44078}
This commit is contained in:
Bradley.Meck 2017-03-23 11:33:38 -07:00 committed by Commit bot
parent e741957a6f
commit b123ee3411
6 changed files with 50 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/messages.h
View File

@ -450,7 +450,6 @@ class ErrorUtils : public AllStatic {
T(ProxyTrapReturnedFalsish, "'%' on proxy: trap returned falsish") \
T(ProxyTrapReturnedFalsishFor, \
"'%' on proxy: trap returned falsish for property '%'") \
T(ReadGlobalReferenceThroughProxy, "Trying to access '%' through proxy") \
T(RedefineDisallowed, "Cannot redefine property: %") \
T(RedefineExternalArray, \
"Cannot redefine a property of an object with external array elements") \

6
src/objects.cc
View File

@ -1051,12 +1051,6 @@ MaybeHandle<Object> JSProxy::GetProperty(Isolate* isolate,
Handle<Object> receiver,
bool* was_found) {
*was_found = true;
if (receiver->IsJSGlobalObject()) {
THROW_NEW_ERROR(
isolate,
NewTypeError(MessageTemplate::kReadGlobalReferenceThroughProxy, name),
Object);
}
DCHECK(!name->IsPrivate());
STACK_CHECK(isolate, MaybeHandle<Object>());

8
test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
View File

@ -217,7 +217,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(12),
B(LdaConstant), U8(11),
B(Star), R(13),
@ -701,7 +701,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(12),
B(LdaConstant), U8(11),
B(Star), R(13),
@ -1219,7 +1219,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(12),
B(LdaConstant), U8(11),
B(Star), R(13),
@ -1627,7 +1627,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(11),
B(LdaConstant), U8(10),
B(Star), R(12),

8
test/cctest/interpreter/bytecode_expectations/ForOf.golden
View File

@ -85,7 +85,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(12),
B(LdaConstant), U8(8),
B(Star), R(13),
@ -226,7 +226,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(13),
B(LdaConstant), U8(8),
B(Star), R(14),
@ -380,7 +380,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(12),
B(LdaConstant), U8(8),
B(Star), R(13),
@ -524,7 +524,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(11),
B(LdaConstant), U8(10),
B(Star), R(12),

2
test/cctest/interpreter/bytecode_expectations/Generators.golden
View File

@ -493,7 +493,7 @@ bytecodes: [
B(TestTypeOf), U8(5),
B(JumpIfFalse), U8(4),
B(Jump), U8(18),
B(Wide), B(LdaSmi), I16(130),
B(Wide), B(LdaSmi), I16(129),
B(Star), R(11),
B(LdaConstant), U8(10),
B(Star), R(12),

41
test/mjsunit/es6/global-proto-proxy.js Normal file
View File

@ -0,0 +1,41 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var global = this;
;(function () {
var calledDelete = false;
var calledGet = false;
var calledHas = false;
var calledSet = false;
var target = {};
var assertEquals = global.assertEquals;
var proxy = new Proxy(target, {
has(target, property) {
calledHas = true;
return Reflect.has(target, property);
},
get(target, property, receiver) {
calledGet = true;
return Reflect.get(target, property, receiver);
},
set(targer, property, value, receiver) {
calledSet = true;
return Reflect.set(target, property, value, receiver);
},
delete(target, property, receiver) {
calledDelete = true;
return Reflect.delete(target, property, receiver);
}
});
Object.setPrototypeOf(global, proxy);
getGlobal;
assertTrue(calledGet);
makeGlobal = 2;
assertTrue(calledSet);
"findGlobal" in global;
assertTrue(calledHas);
var deletedOwn = delete makeGlobal;
assertTrue(deletedOwn);
assertEquals(void 0, makeGlobal);
})();