Bug 159756 – Object.prototype.__proto__ getter still provides access to WindowProxy

• Status: RESOLVED
• Resolution: CONFIGURATION CHANGED
• Component: JavaScriptCore

[Mark S. Miller]

Re https://bugs.webkit.org/show_bug.cgi?id=141865 , the underlying problem remains. At https://bugs.webkit.org/show_bug.cgi?id=141865#c11 I write:



The more interesting case is:

>>> (function(){'use strict'; var g = Object.getOwnPropertyDescriptor(Object.prototype, '__proto__').get; return g();})();

so that g is obtained from a local environment record rather than the global one. On this, FF Nightly 50.0a1 (2016-07-13) correctly throws

TypeError: get __proto__ method called on incompatible undefined

whereas Webkit Nightly 9.1.1 (11601.6.17, r203190) returns the WindowPrototype, which is just as dangerous as ever.


At https://bugs.webkit.org/show_bug.cgi?id=141865#c9 Brent asked me to open a new bug if this is still a problem. Hence this new bug.

[Keith Miller]

On r203223 I get the following output.

>>> (function(){'use strict'; var g = Object.getOwnPropertyDescriptor(Object.prototype, '__proto__').get; return g();})();
Exception: TypeError: Can't convert undefined or null to object

Is this incorrect?

[Mark S. Miller]

Created attachment 283694 [details]
Screenshot of failure on r203223 in debugger console

[Mark S. Miller]

That's not the behavior I am seeing in WebKit Nightly just now on 9.1.1 (11601.6.17, r203223). See the attached screenshot.

[Mark S. Miller]

In that screenshot, nevermind the red line about a failure to load above the real example. That is completely unrelated.

[Mark S. Miller]

Can this bug be closed now? I think the issues are fixed.