Bug 65832

Summary:

Non-extensibility does not prevent mutating [[Prototype]]

Product:

WebKit

Reporter:

Mark S. Miller <erights>

Component:

JavaScriptCore

Assignee:

Oliver Hunt <oliver>

Status:

RESOLVED FIXED

Severity:

Major

CC:

barraclough, erights, oliver

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

URL:

http://es5.github.com/#x8.6.2

Attachments:

Description	Flags
Patch	barraclough: review+

Description Mark S. Miller 2011-08-07 15:15:00 PDT

ES5.1 section 8.6.2 states:

"In addition, if [[Extensible]] is false the value of the [[Class]] and [[Prototype]] internal properties of the object may not be modified."

However, on Safari 5.0.6 through WebKit Nightly 5.0.6 (5533.22.3, r92569), we see:

> var x = Object.freeze({});
> var y = {};
> x.__proto__ = y;
Object
> y.isPrototypeOf(x);
true
> Object.getPrototypeOf(x) === y;
true

I'm classifying this as Severity=Major, since it is the only currently known showstopper preventing SES from being able to run securely using a verification-only strategy.

Comment 1 Oliver Hunt 2011-08-08 11:59:36 PDT

Created attachment 103271 [details]
Patch

Comment 2 Oliver Hunt 2011-08-08 12:10:37 PDT

Committed r92618: <http://trac.webkit.org/changeset/92618>

Comment 3 Mark S. Miller 2012-02-12 14:20:20 PST

See https://bugs.webkit.org/show_bug.cgi?id=78438