Reviewers: rossberg,
Message:
Committed patchset #1 manually as r20138 (presubmit successful).
Description:
Fix missing access check in Runtime_SetPrototype.
[email protected]
BUG=chromium:354123
TEST=cctest/test-api/Regress354123
LOG=y
Committed: https://code.google.com/p/v8/source/detail?r=20138
Please review this at https://codereview.chromium.org/205033011/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+53, -0 lines):
M src/runtime.cc
M test/cctest/test-api.cc
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
7edf0130676b4c205838e5d3b35c263e61b9c110..bb27a6e4bfd519b684d0b24b6d8b1373ed062d9a
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -1679,6 +1679,14 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_SetPrototype)
{
ASSERT(args.length() == 2);
CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
+ if (obj->IsAccessCheckNeeded() &&
+ !isolate->MayNamedAccessWrapper(obj,
+ isolate->factory()->proto_string(),
+ v8::ACCESS_SET)) {
+ isolate->ReportFailedAccessCheckWrapper(obj, v8::ACCESS_SET);
+ RETURN_IF_SCHEDULED_EXCEPTION(isolate);
+ return isolate->heap()->undefined_value();
+ }
if (obj->map()->is_observed()) {
Handle<Object> old_value(
GetPrototypeSkipHiddenPrototypes(isolate, *obj), isolate);
Index: test/cctest/test-api.cc
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index
74afab2c1b069e63d6ff40781f452f89f9c920b1..8af678098423605d044831536ab9413960234178
100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -22413,3 +22413,48 @@ TEST(AllowJavascriptExecutionScope) {
CompileRun("1+1");
}
}
+
+
+TEST(Regress354123) {
+ LocalContext current;
+ v8::Isolate* isolate = current->GetIsolate();
+ v8::HandleScope scope(isolate);
+
+ v8::Handle<v8::ObjectTemplate> templ = v8::ObjectTemplate::New(isolate);
+ templ->SetAccessCheckCallbacks(NamedAccessCounter, IndexedAccessCounter);
+ current->Global()->Set(v8_str("friend"), templ->NewInstance());
+
+ // Test access using __proto__ from the prototype chain.
+ named_access_count = 0;
+ CompileRun("friend.__proto__ = {};");
+ CHECK_EQ(2, named_access_count);
+ CompileRun("friend.__proto__;");
+ CHECK_EQ(4, named_access_count);
+
+ // Test access using __proto__ as a hijacked function (A).
+ named_access_count = 0;
+ CompileRun("var p = Object.prototype;"
+ "var f = Object.getOwnPropertyDescriptor(p, '__proto__').set;"
+ "f.call(friend, {});");
+ CHECK_EQ(1, named_access_count);
+ CompileRun("var p = Object.prototype;"
+ "var f = Object.getOwnPropertyDescriptor(p, '__proto__').get;"
+ "f.call(friend);");
+ CHECK_EQ(2, named_access_count);
+
+ // Test access using __proto__ as a hijacked function (B).
+ named_access_count = 0;
+ CompileRun("var f = Object.prototype.__lookupSetter__('__proto__');"
+ "f.call(friend, {});");
+ CHECK_EQ(1, named_access_count);
+ CompileRun("var f = Object.prototype.__lookupGetter__('__proto__');"
+ "f.call(friend);");
+ CHECK_EQ(2, named_access_count);
+
+ // Test access using Object.setPrototypeOf reflective method.
+ named_access_count = 0;
+ CompileRun("Object.setPrototypeOf(friend, {});");
+ CHECK_EQ(1, named_access_count);
+ CompileRun("Object.getPrototypeOf(friend);");
+ CHECK_EQ(2, named_access_count);
+}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
