Title: [207518] trunk
Revision
207518
Author
mark....@apple.com
Date
2016-10-18 20:52:29 -0700 (Tue, 18 Oct 2016)

Log Message

Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
https://bugs.webkit.org/show_bug.cgi?id=154377
<rdar://problem/27330808>

Reviewed by Filip Pizlo and Saam Barati.

JSTests:

* stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.

Source/_javascript_Core:

In a scenario where we cache the __proto__ accessors in global variables, and
later explicitly invoke those accessors as functions, the spec for Function Calls
(see https://tc39.github.io/ecma262/#sec-function-calls) states that the function
ref value is of type Reference, and base of ref is an Environment Record.  Then,
it follows that the thisValue should be set to refEnv.WithBaseObject()
(see section 4.b.ii of 12.3.4.1 at
https://tc39.github.io/ecma262/#sec-function-calls-runtime-semantics-evaluation).

refEnv in this case is the environment record that the cached accessors were
found in i.e. the global object.  The WithBaseObject() of the global object is
undefined (see details about WithBaseObject at
https://tc39.github.io/ecma262/#sec-environment-records).

Hence, the __proto__ accessors should see a thisValue of undefined, and throw
TypeErrors.  See https://tc39.github.io/ecma262/#sec-get-object.prototype.__proto__,
https://tc39.github.io/ecma262/#sec-set-object.prototype.__proto__,
https://tc39.github.io/ecma262/#sec-toobject, and
https://tc39.github.io/ecma262/#sec-requireobjectcoercible.

In JSC's implementation, the callee needs to do a ToThis operation on the
incoming "this" argument in order to get the specified thisValue.  The
implementations of the __proto__ accessors were not doing this correctly.  This
has now been fixed.

* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncProtoGetter):
(JSC::globalFuncProtoSetter):

LayoutTests:

* http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt:
* http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt:
* http/tests/security/xss-DENIED-non-shadowable-propterty-with-iframe-proto-expected.txt:
* http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto-expected.txt:
* http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html:
* js/dom/activation-proto-expected.txt:
* js/dom/script-tests/activation-proto.js:
* js/object-literal-shorthand-construction-expected.txt:
* js/script-tests/object-literal-shorthand-construction.js:
* js/script-tests/sloppy-getter-setter-global-object.js:
* js/sloppy-getter-setter-global-object-expected.txt:

Modified Paths

Added Paths

Diff

Modified: trunk/JSTests/ChangeLog (207517 => 207518)


--- trunk/JSTests/ChangeLog	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/JSTests/ChangeLog	2016-10-19 03:52:29 UTC (rev 207518)
@@ -1,3 +1,13 @@
+2016-10-18  Mark Lam  <mark....@apple.com>
+
+        Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
+        https://bugs.webkit.org/show_bug.cgi?id=154377
+        <rdar://problem/27330808>
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
+
 2016-10-18  Keith Miller  <keith_mil...@apple.com>
 
         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow

Added: trunk/JSTests/stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js (0 => 207518)


--- trunk/JSTests/stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js	                        (rev 0)
+++ trunk/JSTests/stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js	2016-10-19 03:52:29 UTC (rev 207518)
@@ -0,0 +1,38 @@
+//@ runFTLNoCJIT
+
+function shouldEqual(testId, actual, expected) {
+    if (actual != expected) {
+        throw testId + ": ERROR: expect " + expected + ", actual " + actual;
+    }
+}
+
+let numberOfIterations = 10000;
+
+function testInvokeGetter() {
+    var getter = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__").get;
+    return (function() { return getter(); })();
+}
+noInline(testInvokeGetter);
+
+function testInvokeSetter() {
+    var setter = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__").set;
+    return (function() { return setter({}); })();
+}
+noInline(testInvokeSetter);
+
+function runTest(testId, test, expectedResult, expectedException) {
+    for (var i = 0; i < numberOfIterations; i++) {
+        var exception;
+        var result;
+        try {
+            result = test({});
+        } catch (e) {
+            exception = "" + e;
+        }
+        shouldEqual(testId, result, expectedResult);
+        shouldEqual(testId, exception, expectedException);
+    }
+}
+
+runTest(10000, testInvokeGetter, undefined, "TypeError: Object.prototype.__proto__ called on null or undefined");
+runTest(10100, testInvokeSetter, undefined, "TypeError: Object.prototype.__proto__ called on null or undefined");

Modified: trunk/LayoutTests/ChangeLog (207517 => 207518)


--- trunk/LayoutTests/ChangeLog	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/ChangeLog	2016-10-19 03:52:29 UTC (rev 207518)
@@ -1,3 +1,23 @@
+2016-10-18  Mark Lam  <mark....@apple.com>
+
+        Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
+        https://bugs.webkit.org/show_bug.cgi?id=154377
+        <rdar://problem/27330808>
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        * http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt:
+        * http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt:
+        * http/tests/security/xss-DENIED-non-shadowable-propterty-with-iframe-proto-expected.txt:
+        * http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto-expected.txt:
+        * http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html:
+        * js/dom/activation-proto-expected.txt:
+        * js/dom/script-tests/activation-proto.js:
+        * js/object-literal-shorthand-construction-expected.txt:
+        * js/script-tests/object-literal-shorthand-construction.js:
+        * js/script-tests/sloppy-getter-setter-global-object.js:
+        * js/sloppy-getter-setter-global-object-expected.txt:
+
 2016-10-18  Chris Dumez  <cdu...@apple.com>
 
         [Web IDL] Kill support for [LegacyConstructorTemplate=Event] / [LegacyInitializedByEventConstructor]

Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt (207517 => 207518)


--- trunk/LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -4,7 +4,7 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS __proto__ = targetWindow threw exception TypeError: Cannot set prototype of this object.
+PASS __proto__ = targetWindow threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
 PASS targetWindow.myinput threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
 PASS: successfullyParsed should be 'true' and is.
 

Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt (207517 => 207518)


--- trunk/LayoutTests/http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -7,7 +7,7 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS __proto__ = targetWindow threw exception TypeError: Cannot set prototype of this object.
+PASS __proto__ = targetWindow threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
 PASS: successfullyParsed should be 'true' and is.
 
 TEST COMPLETE

Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-non-shadowable-propterty-with-iframe-proto-expected.txt (207517 => 207518)


--- trunk/LayoutTests/http/tests/security/xss-DENIED-non-shadowable-propterty-with-iframe-proto-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-non-shadowable-propterty-with-iframe-proto-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -4,7 +4,7 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS __proto__ = targetWindow threw exception TypeError: Cannot set prototype of this object.
+PASS __proto__ = targetWindow threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
 PASS: location === originalLocation should be 'true' and is.
 PASS: this.location === originalLocation should be 'true' and is.
 PASS: successfullyParsed should be 'true' and is.

Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto-expected.txt (207517 => 207518)


--- trunk/LayoutTests/http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -4,7 +4,8 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS __proto__ = targetWindow threw exception TypeError: Cannot set prototype of this object.
+PASS this.__proto__ = targetWindow threw exception TypeError: Cannot set prototype of this object.
+PASS __proto__ = targetWindow threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
 PASS: innerHeight === originalInnerHeight should be 'true' and is.
 PASS: this.innerHeight === originalInnerHeight should be 'true' and is.
 PASS: successfullyParsed should be 'true' and is.

Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html (207517 => 207518)


--- trunk/LayoutTests/http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html	2016-10-19 03:52:29 UTC (rev 207518)
@@ -15,6 +15,7 @@
 window._onload_ = function() {
   originalInnerHeight = innerHeight;
 
+  shouldThrowErrorName("this.__proto__ = targetWindow", "TypeError");
   shouldThrowErrorName("__proto__ = targetWindow", "TypeError");
 
   shouldBeTrue('innerHeight === originalInnerHeight');

Modified: trunk/LayoutTests/js/dom/activation-proto-expected.txt (207517 => 207518)


--- trunk/LayoutTests/js/dom/activation-proto-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/js/dom/activation-proto-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -3,7 +3,7 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS (function() { __proto__.testVariable = 'found'; return window.testVariable; })() is 'found'
+PASS (function() { this.__proto__.testVariable = 'found'; return window.testVariable; })() is 'found'
 PASS successfullyParsed is true
 
 TEST COMPLETE

Modified: trunk/LayoutTests/js/dom/script-tests/activation-proto.js (207517 => 207518)


--- trunk/LayoutTests/js/dom/script-tests/activation-proto.js	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/js/dom/script-tests/activation-proto.js	2016-10-19 03:52:29 UTC (rev 207518)
@@ -4,4 +4,4 @@
 
 );
 
-shouldBe("(function() { __proto__.testVariable = 'found'; return window.testVariable; })()", "'found'");
+shouldBe("(function() { this.__proto__.testVariable = 'found'; return window.testVariable; })()", "'found'");

Modified: trunk/LayoutTests/js/object-literal-shorthand-construction-expected.txt (207517 => 207518)


--- trunk/LayoutTests/js/object-literal-shorthand-construction-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/js/object-literal-shorthand-construction-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -61,8 +61,10 @@
 PASS !!Object.getOwnPropertyDescriptor({set x(value){}}, 'x').set is true
 PASS !!Object.getOwnPropertyDescriptor({set 'x'(value){}}, 'x').set is true
 PASS !!Object.getOwnPropertyDescriptor({set 42(value){}}, '42').set is true
-PASS __proto__ = [] threw exception TypeError: Cannot set prototype of this object.
-PASS ({__proto__: __proto__}) instanceof Array is false
+PASS this.__proto__ = [] threw exception TypeError: Cannot set prototype of this object.
+PASS ({__proto__: this.__proto__}) instanceof Array is false
+PASS __proto__ = [] threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
+PASS ({__proto__: __proto__}) instanceof Array threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
 PASS successfullyParsed is true
 
 TEST COMPLETE

Modified: trunk/LayoutTests/js/script-tests/object-literal-shorthand-construction.js (207517 => 207518)


--- trunk/LayoutTests/js/script-tests/object-literal-shorthand-construction.js	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/js/script-tests/object-literal-shorthand-construction.js	2016-10-19 03:52:29 UTC (rev 207518)
@@ -110,5 +110,7 @@
 shouldBeTrue("!!Object.getOwnPropertyDescriptor({set 42(value){}}, '42').set");
 
 // __proto__ shorthand should not modify the prototype.
-shouldThrow("__proto__ = []");
-shouldBeFalse("({__proto__: __proto__}) instanceof Array");
+shouldThrow("this.__proto__ = []");
+shouldBeFalse("({__proto__: this.__proto__}) instanceof Array");
+shouldThrow("__proto__ = []", '"TypeError: Object.prototype.__proto__ called on null or undefined"');
+shouldThrow("({__proto__: __proto__}) instanceof Array", '"TypeError: Object.prototype.__proto__ called on null or undefined"');

Modified: trunk/LayoutTests/js/script-tests/sloppy-getter-setter-global-object.js (207517 => 207518)


--- trunk/LayoutTests/js/script-tests/sloppy-getter-setter-global-object.js	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/js/script-tests/sloppy-getter-setter-global-object.js	2016-10-19 03:52:29 UTC (rev 207518)
@@ -25,12 +25,12 @@
 shouldNotThrow("Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get()");
 shouldNotThrow("Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set(['foo'])");
 
-shouldThrow("(0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get)()", "\"TypeError: Can't convert undefined or null to object\"");
-shouldThrow("(0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set)(['foo'])", "\"TypeError: Can't convert undefined or null to object\"");
+shouldThrow("(0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get)()", "\"TypeError: Object.prototype.__proto__ called on null or undefined\"");
+shouldThrow("(0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set)(['foo'])", "\"TypeError: Object.prototype.__proto__ called on null or undefined\"");
 
 
 var top_level_sloppy_getter = Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get;
-shouldNotThrow("top_level_sloppy_getter();");
+shouldThrow("top_level_sloppy_getter();", "\"TypeError: Object.prototype.__proto__ called on null or undefined\"");
 
 var top_level_sloppy_setter = Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set;
-shouldThrow("top_level_sloppy_setter(['foo']);");
+shouldThrow("top_level_sloppy_setter(['foo']);", "\"TypeError: Object.prototype.__proto__ called on null or undefined\"");

Modified: trunk/LayoutTests/js/sloppy-getter-setter-global-object-expected.txt (207517 => 207518)


--- trunk/LayoutTests/js/sloppy-getter-setter-global-object-expected.txt	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/LayoutTests/js/sloppy-getter-setter-global-object-expected.txt	2016-10-19 03:52:29 UTC (rev 207518)
@@ -8,10 +8,10 @@
 PASS Object.prototype.valueOf.call(null); threw exception TypeError: null is not an object (evaluating 'Object.prototype.valueOf.call(null)').
 PASS Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get() did not throw exception.
 PASS Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set(['foo']) did not throw exception.
-PASS (0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get)() threw exception TypeError: Can't convert undefined or null to object.
-PASS (0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set)(['foo']) threw exception TypeError: Can't convert undefined or null to object.
-PASS top_level_sloppy_getter(); did not throw exception.
-PASS top_level_sloppy_setter(['foo']); threw exception TypeError: Cannot set prototype of this object.
+PASS (0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').get)() threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
+PASS (0,Object.getOwnPropertyDescriptor(Object.prototype,'__proto__').set)(['foo']) threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
+PASS top_level_sloppy_getter(); threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
+PASS top_level_sloppy_setter(['foo']); threw exception TypeError: Object.prototype.__proto__ called on null or undefined.
 PASS successfullyParsed is true
 
 TEST COMPLETE

Modified: trunk/Source/_javascript_Core/ChangeLog (207517 => 207518)


--- trunk/Source/_javascript_Core/ChangeLog	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-10-19 03:52:29 UTC (rev 207518)
@@ -1,3 +1,39 @@
+2016-10-18  Mark Lam  <mark....@apple.com>
+
+        Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
+        https://bugs.webkit.org/show_bug.cgi?id=154377
+        <rdar://problem/27330808>
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        In a scenario where we cache the __proto__ accessors in global variables, and
+        later explicitly invoke those accessors as functions, the spec for Function Calls
+        (see https://tc39.github.io/ecma262/#sec-function-calls) states that the function
+        ref value is of type Reference, and base of ref is an Environment Record.  Then,
+        it follows that the thisValue should be set to refEnv.WithBaseObject()
+        (see section 4.b.ii of 12.3.4.1 at
+        https://tc39.github.io/ecma262/#sec-function-calls-runtime-semantics-evaluation).
+
+        refEnv in this case is the environment record that the cached accessors were
+        found in i.e. the global object.  The WithBaseObject() of the global object is
+        undefined (see details about WithBaseObject at
+        https://tc39.github.io/ecma262/#sec-environment-records).
+
+        Hence, the __proto__ accessors should see a thisValue of undefined, and throw
+        TypeErrors.  See https://tc39.github.io/ecma262/#sec-get-object.prototype.__proto__,
+        https://tc39.github.io/ecma262/#sec-set-object.prototype.__proto__,
+        https://tc39.github.io/ecma262/#sec-toobject, and
+        https://tc39.github.io/ecma262/#sec-requireobjectcoercible.
+
+        In JSC's implementation, the callee needs to do a ToThis operation on the
+        incoming "this" argument in order to get the specified thisValue.  The
+        implementations of the __proto__ accessors were not doing this correctly.  This
+        has now been fixed.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+
 2016-10-18  Sam Weinig  <s...@webkit.org>
 
         Replace std::experimental::variant with WTF::Variant (or similar)

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp (207517 => 207518)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp	2016-10-19 02:43:44 UTC (rev 207517)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp	2016-10-19 03:52:29 UTC (rev 207518)
@@ -53,6 +53,8 @@
 
 namespace JSC {
 
+static const char* const ObjectProtoCalledOnNullOrUndefinedError = "Object.prototype.__proto__ called on null or undefined";
+
 template<typename CallbackWhenNoException>
 static ALWAYS_INLINE typename std::result_of<CallbackWhenNoException(JSString::SafeView&)>::type toSafeView(ExecState* exec, JSValue value, CallbackWhenNoException callback)
 {
@@ -870,11 +872,11 @@
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    if (exec->thisValue().isUndefinedOrNull())
-        return throwVMTypeError(exec, scope, ASCIILiteral("Can't convert undefined or null to object"));
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    if (thisValue.isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(ObjectProtoCalledOnNullOrUndefinedError));
 
-    JSObject* thisObject = jsDynamicCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode));
-
+    JSObject* thisObject = jsDynamicCast<JSObject*>(thisValue);
     if (!thisObject) {
         JSObject* prototype = exec->thisValue().synthesizePrototype(exec);
         if (UNLIKELY(!prototype))
@@ -890,12 +892,13 @@
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    if (exec->thisValue().isUndefinedOrNull())
-        return throwVMTypeError(exec, scope, ASCIILiteral("Can't convert undefined or null to object"));
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    if (thisValue.isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(ObjectProtoCalledOnNullOrUndefinedError));
 
     JSValue value = exec->argument(0);
 
-    JSObject* thisObject = jsDynamicCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode));
+    JSObject* thisObject = jsDynamicCast<JSObject*>(thisValue);
 
     // Setting __proto__ of a primitive should have no effect.
     if (!thisObject)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to