Reviewers: Michael Starzinger, rossberg,
Description:
ES6: Remove __proto__ setter poison pill
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-set-object.prototype.__proto__
The __proto__ setter should be reusable on other objects.
BUG=v8:2804
LOG=y
Please review this at https://codereview.chromium.org/103343005/
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+26, -68 lines):
D test/mjsunit/proto-poison.js
M src/messages.js
M src/v8natives.js
A + test/mjsunit/proto-accessor.js
Index: test/mjsunit/proto-poison.js
diff --git a/test/mjsunit/proto-poison.js b/test/mjsunit/proto-poison.js
deleted file mode 100644
index
ca3b5d6d061a21819a6b000fee84397231ad307f..0000000000000000000000000000000000000000
--- a/test/mjsunit/proto-poison.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Check that the __proto__ accessor is properly poisoned when extracted
-// from Object.prototype using the property descriptor.
-var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
-assertEquals("function", typeof desc.get);
-assertEquals("function", typeof desc.set);
-assertDoesNotThrow("desc.get.call({})");
-assertThrows("desc.set.call({})", TypeError);
-
-// Check that any redefinition of the __proto__ accessor causes poising
-// to cease and the accessor to be extracted normally.
-Object.defineProperty(Object.prototype, "__proto__", { get:function(){} });
-desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
-assertDoesNotThrow("desc.get.call({})");
-assertThrows("desc.set.call({})", TypeError);
-Object.defineProperty(Object.prototype, "__proto__", { set:function(x){}
});
-desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
-assertDoesNotThrow("desc.get.call({})");
-assertDoesNotThrow("desc.set.call({})");
Index: src/messages.js
diff --git a/src/messages.js b/src/messages.js
index
c7096724ace127053e80327f116de8c3d34ac646..a65de1e967b2f8e19dfba8949dca28d067885340
100644
--- a/src/messages.js
+++ b/src/messages.js
@@ -104,7 +104,6 @@ var kMessages = {
observe_perform_non_string: ["Invalid non-string changeType"],
observe_perform_non_function: ["Cannot perform non-function"],
observe_notify_non_notifier: ["notify called on non-notifier object"],
- proto_poison_pill: ["Generic use of __proto__ accessor not
allowed"],
not_typed_array: ["this is not a typed array."],
invalid_argument: ["invalid_argument"],
data_view_not_array_buffer: ["First argument to DataView constructor
must be an ArrayBuffer"],
Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index
96b88c5285c9962d479fa75d0e71031cd0c35b6c..8adb9d673b27f1d499a77c7d5b60684351db193d
100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -388,8 +388,7 @@ function FromPropertyDescriptor(desc) {
}
// Must be an AccessorDescriptor then. We never return a generic
descriptor.
return { get: desc.getGet(),
- set: desc.getSet() === ObjectSetProto ? ObjectPoisonProto
- : desc.getSet(),
+ set: desc.getSet(),
enumerable: desc.isEnumerable(),
configurable: desc.isConfigurable() };
}
@@ -1362,12 +1361,6 @@ function ObjectSetProto(obj) {
}
-// Harmony __proto__ poison pill.
-function ObjectPoisonProto(obj) {
- throw MakeTypeError("proto_poison_pill", []);
-}
-
-
function ObjectConstructor(x) {
if (%_IsConstructCall()) {
if (x == null) return this;
@@ -1387,8 +1380,6 @@ function SetUpObject() {
%SetNativeFlag($Object);
%SetCode($Object, ObjectConstructor);
- %FunctionSetName(ObjectPoisonProto, "__proto__");
- %FunctionRemovePrototype(ObjectPoisonProto);
%SetExpectedNumberOfProperties($Object, 4);
%SetProperty($Object.prototype, "constructor", $Object, DONT_ENUM);
Index: test/mjsunit/proto-accessor.js
diff --git a/test/mjsunit/proto-poison.js b/test/mjsunit/proto-accessor.js
similarity index 71%
rename from test/mjsunit/proto-poison.js
rename to test/mjsunit/proto-accessor.js
index
ca3b5d6d061a21819a6b000fee84397231ad307f..fefbf6df008626f385842daab103d81f9386c755
100644
--- a/test/mjsunit/proto-poison.js
+++ b/test/mjsunit/proto-accessor.js
@@ -25,21 +25,34 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Check that the __proto__ accessor is properly poisoned when extracted
-// from Object.prototype using the property descriptor.
var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
assertEquals("function", typeof desc.get);
assertEquals("function", typeof desc.set);
assertDoesNotThrow("desc.get.call({})");
-assertThrows("desc.set.call({})", TypeError);
+assertDoesNotThrow("desc.set.call({}, {})");
+
+
+var obj = {};
+var obj2 = {};
+desc.set.call(obj, obj2);
+assertEquals(obj.__proto__, obj2);
+assertEquals(desc.get.call(obj), obj2);
+
+
+// Check that any redefinition of the __proto__ accessor works.
+ Object.defineProperty(Object.prototype, "__proto__", { get:function() {
+ return 42;
+ } });
+ assertEquals({}.__proto__, 42);
+ assertEquals(desc.get.call({}), Object.prototype);
+
+
+var desc2 = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertEquals(desc2.get.call({}), 42);
+assertDoesNotThrow("desc2.set.call({})");
+
-// Check that any redefinition of the __proto__ accessor causes poising
-// to cease and the accessor to be extracted normally.
-Object.defineProperty(Object.prototype, "__proto__", { get:function(){} });
-desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
-assertDoesNotThrow("desc.get.call({})");
-assertThrows("desc.set.call({})", TypeError);
Object.defineProperty(Object.prototype, "__proto__", { set:function(x){}
});
-desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
-assertDoesNotThrow("desc.get.call({})");
-assertDoesNotThrow("desc.set.call({})");
+var desc3 = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertDoesNotThrow("desc3.get.call({})");
+assertDoesNotThrow("desc3.set.call({})");
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
