... and as discussed there's a missing access check when walking the
prototype
chain of the home object (e.g., would look beyond a window to which we don't
have access)
https://codereview.chromium.org/527963002/diff/20001/src/runtime.cc
File src/runtime.cc (right):
https://codereview.chromium.org/527963002/diff/20001/src/runtime.cc#newcode2084
src/runtime.cc:2084: if (it.IsFound()) {
You don't need this it.IsFound() either... GetProperty will return
undefined for you.
https://codereview.chromium.org/527963002/diff/20001/test/mjsunit/harmony/super.js
File test/mjsunit/harmony/super.js (right):
https://codereview.chromium.org/527963002/diff/20001/test/mjsunit/harmony/super.js#newcode72
test/mjsunit/harmony/super.js:72: assertTrue(this === derived);
assertSame
https://codereview.chromium.org/527963002/
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
