Hey Rico, this version passes webkit layout test http/tests/security/xss-DENIED-defineProperty.html.
The issue was that when going through the SetLocalPropertyIgnoreAttributes path, the object is first Normalized. This breaks when the object is a JSGlobalProxy - Normalization copies properties from the GlobalObject to the Proxy which allows
the properties to be accessed without security checks and also breaks the invariant that JSGlobalPRoxy should never have properties on it directly. http://codereview.chromium.org/6035014/ -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
