This CL also fixes http://code.google.com/p/v8/issues/detail?id=1083.
On Fri, Jan 28, 2011 at 4:56 PM, <[email protected]> wrote: > Hey Rico, > > this version passes webkit layout test > http/tests/security/xss-DENIED-defineProperty.html. > > The issue was that when going through the SetLocalPropertyIgnoreAttributes > path, > the object is first Normalized. This breaks when the object is a > JSGlobalProxy - > Normalization copies properties from the GlobalObject to the Proxy which > allows > the properties to be accessed without security checks and also breaks the > invariant that JSGlobalPRoxy should never have properties on it directly. > > http://codereview.chromium.org/6035014/ > -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
