Revision: 9442
Author: [email protected]
Date: Tue Sep 27 01:04:16 2011
Log: Merge revision 9434 to trunk
Review URL: http://codereview.chromium.org/8055008
http://code.google.com/p/v8/source/detail?r=9442
Modified:
/trunk/src/objects.cc
/trunk/src/version.cc
/trunk/test/cctest/test-api.cc
=======================================
--- /trunk/src/objects.cc Thu Sep 15 00:25:40 2011
+++ /trunk/src/objects.cc Tue Sep 27 01:04:16 2011
@@ -3024,6 +3024,13 @@
isolate->context()->global_context()->object_function());
if (!maybe_obj->ToObject(&hidden_obj)) return maybe_obj;
}
+ // Don't allow leakage of the hidden object through accessors
+ // on Object.prototype.
+ {
+ MaybeObject* maybe_obj =
+ JSObject::cast(hidden_obj)->SetPrototype(heap->null_value(),
false);
+ if (maybe_obj->IsFailure()) return maybe_obj;
+ }
return obj->SetHiddenPropertiesObject(hidden_obj);
} else {
return heap->undefined_value();
=======================================
--- /trunk/src/version.cc Thu Sep 15 00:25:40 2011
+++ /trunk/src/version.cc Tue Sep 27 01:04:16 2011
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 6
#define BUILD_NUMBER 4
-#define PATCH_LEVEL 0
+#define PATCH_LEVEL 1
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
=======================================
--- /trunk/test/cctest/test-api.cc Wed Sep 7 05:44:28 2011
+++ /trunk/test/cctest/test-api.cc Tue Sep 27 01:04:16 2011
@@ -1806,6 +1806,34 @@
CHECK(obj->DeleteHiddenValue(key));
CHECK(obj->GetHiddenValue(key).IsEmpty());
}
+
+
+THREADED_TEST(Regress97784) {
+ // Regression test for crbug.com/97784
+ // Messing with the Object.prototype should not have effect on
+ // hidden properties.
+ v8::HandleScope scope;
+ LocalContext env;
+
+ v8::Local<v8::Object> obj = v8::Object::New();
+ v8::Local<v8::String> key = v8_str("hidden");
+
+ CompileRun(
+ "set_called = false;"
+ "Object.defineProperty("
+ " Object.prototype,"
+ " 'hidden',"
+ " {get: function() { return 45; },"
+ " set: function() { set_called = true; }})");
+
+ CHECK(obj->GetHiddenValue(key).IsEmpty());
+ // Make sure that the getter and setter from Object.prototype is not
invoked.
+ // If it did we would have full access to the hidden properties in
+ // the accessor.
+ CHECK(obj->SetHiddenValue(key, v8::Integer::New(42)));
+ ExpectFalse("set_called");
+ CHECK_EQ(42, obj->GetHiddenValue(key)->Int32Value());
+}
static bool interceptor_for_hidden_properties_called;
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
