Reviewers: danno,
Description:
Merge revision 9434 to trunk
Please review this at http://codereview.chromium.org/8055008/
SVN Base: http://v8.googlecode.com/svn/trunk/
Affected files:
M src/objects.cc
M src/version.cc
M test/cctest/test-api.cc
Index: src/objects.cc
===================================================================
--- src/objects.cc (revision 9438)
+++ src/objects.cc (working copy)
@@ -3024,6 +3024,13 @@
isolate->context()->global_context()->object_function());
if (!maybe_obj->ToObject(&hidden_obj)) return maybe_obj;
}
+ // Don't allow leakage of the hidden object through accessors
+ // on Object.prototype.
+ {
+ MaybeObject* maybe_obj =
+ JSObject::cast(hidden_obj)->SetPrototype(heap->null_value(),
false);
+ if (maybe_obj->IsFailure()) return maybe_obj;
+ }
return obj->SetHiddenPropertiesObject(hidden_obj);
} else {
return heap->undefined_value();
Index: src/version.cc
===================================================================
--- src/version.cc (revision 9438)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 6
#define BUILD_NUMBER 4
-#define PATCH_LEVEL 0
+#define PATCH_LEVEL 1
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/cctest/test-api.cc
===================================================================
--- test/cctest/test-api.cc (revision 9438)
+++ test/cctest/test-api.cc (working copy)
@@ -1808,6 +1808,34 @@
}
+THREADED_TEST(Regress97784) {
+ // Regression test for crbug.com/97784
+ // Messing with the Object.prototype should not have effect on
+ // hidden properties.
+ v8::HandleScope scope;
+ LocalContext env;
+
+ v8::Local<v8::Object> obj = v8::Object::New();
+ v8::Local<v8::String> key = v8_str("hidden");
+
+ CompileRun(
+ "set_called = false;"
+ "Object.defineProperty("
+ " Object.prototype,"
+ " 'hidden',"
+ " {get: function() { return 45; },"
+ " set: function() { set_called = true; }})");
+
+ CHECK(obj->GetHiddenValue(key).IsEmpty());
+ // Make sure that the getter and setter from Object.prototype is not
invoked.
+ // If it did we would have full access to the hidden properties in
+ // the accessor.
+ CHECK(obj->SetHiddenValue(key, v8::Integer::New(42)));
+ ExpectFalse("set_called");
+ CHECK_EQ(42, obj->GetHiddenValue(key)->Int32Value());
+}
+
+
static bool interceptor_for_hidden_properties_called;
static v8::Handle<Value> InterceptorForHiddenProperties(
Local<String> name, const AccessorInfo& info) {
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
