Bug 161558

Summary:

ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"

Product:

WebKit

Reporter:

Saam Barati <saam>

Component:

JavaScriptCore

Assignee:

Saam Barati <saam>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, cdumez, commit-queue, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, oliver, sukolsak, ticaiolima, ysuzuki

Priority:

Version:

WebKit Local Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

161455

Attachments:

Description	Flags
WIP	none
patch	none

Description Saam Barati 2016-09-02 16:53:24 PDT

This will lead to cycles in the getDirectPrototype() chain.

Comment 1 Saam Barati 2016-09-02 17:51:28 PDT

Created attachment 287840 [details]
WIP

Comment 2 Saam Barati 2016-09-02 17:52:04 PDT

Comment on attachment 287840 [details]
WIP

View in context: https://bugs.webkit.org/attachment.cgi?id=287840&action=review

> JSTests/stress/proxy-dont-infinite-loop.js:18
> +        +err;

I'm not getting an error here. Don't know why. I need to investigate. It's also a very weird err, and can't be accessed in any way, so I have no idea what it is.

Comment 3 Saam Barati 2016-09-06 17:40:55 PDT

Created attachment 288073 [details]
patch

Comment 4 WebKit Commit Bot 2016-09-06 19:50:34 PDT

Comment on attachment 288073 [details]
patch

Clearing flags on attachment: 288073

Committed r205535: <http://trac.webkit.org/changeset/205535>

Comment 5 WebKit Commit Bot 2016-09-06 19:50:38 PDT

All reviewed patches have been landed.  Closing bug.