Bug 65832

Summary: Non-extensibility does not prevent mutating [[Prototype]]
Product: WebKit Reporter: Mark S. Miller <erights>
Component: JavaScriptCoreAssignee: Oliver Hunt <oliver>
Status: RESOLVED FIXED    
Severity: Major CC: barraclough, erights, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
URL: http://es5.github.com/#x8.6.2
Attachments:
Description Flags
Patch barraclough: review+

Mark S. Miller
Reported 2011-08-07 15:15:00 PDT
ES5.1 section 8.6.2 states: "In addition, if [[Extensible]] is false the value of the [[Class]] and [[Prototype]] internal properties of the object may not be modified." However, on Safari 5.0.6 through WebKit Nightly 5.0.6 (5533.22.3, r92569), we see: > var x = Object.freeze({}); > var y = {}; > x.__proto__ = y; Object > y.isPrototypeOf(x); true > Object.getPrototypeOf(x) === y; true I'm classifying this as Severity=Major, since it is the only currently known showstopper preventing SES from being able to run securely using a verification-only strategy.
Attachments
Patch (4.10 KB, patch)
2011-08-08 11:59 PDT, Oliver Hunt 		barraclough: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Oliver Hunt
Comment 1 2011-08-08 11:59:36 PDT
Created attachment 103271 [details] Patch
Oliver Hunt
Comment 2 2011-08-08 12:10:37 PDT
Committed r92618: <http://trac.webkit.org/changeset/92618>
Mark S. Miller
Comment 3 2012-02-12 14:20:20 PST
See https://bugs.webkit.org/show_bug.cgi?id=78438
Note You need to log in before you can comment on or make changes to this bug.