https://codereview.appspot.com/247900043/diff/1/src/com/google/caja/es53.js
File src/com/google/caja/es53.js (right):
https://codereview.appspot.com/247900043/diff/1/src/com/google/caja/es53.js#newcode721
src/com/google/caja/es53.js:721: if (fn.ok___ &&
fn.hasOwnProperty('ok___')) { return fn; }
fn.ok___ is supposed to mark a function as being non-toxic. It depends
on an invariant that all toxic functions inherit directly from
Function.prototype. If it's possible that f.prototype is not
Function.prototype for some toxic function, we should switch to setting
fn.ok___ = fn on line 731 and elsewhere, and test for that here.
https://codereview.appspot.com/247900043/diff/1/src/com/google/caja/es53.js#newcode2633
src/com/google/caja/es53.js:2633: // native ES5 accessors.
FF has had setters forever, so this is potentially a problem if objects
with setters are being tamed. The code below looks right to me.
https://codereview.appspot.com/247900043/
--
---
You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
