Bug 33595 - __proto__ property of plugin object returns null
Summary: __proto__ property of plugin object returns null
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Kent Hansen
Depends on:
Reported: 2010-01-13 05:50 PST by Kent Hansen
Modified: 2010-01-19 07:04 PST (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Kent Hansen 2010-01-13 05:50:32 PST
Example: In LayoutTests/plugins/netscape-enumerate.html, "plugin.testObject.__proto__" gives null as the result. "plugin.testObject.hasOwnProperty('__proto__')" returns false. Shouldn't all objects by definition have a __proto__ property, since it mirrors the internal [[Prototype]] property? In FireFox, a non-null prototype is returned, and the hasOwnProperty() call returns true.

"plugin.testObject instanceof Object" returns true, so the internal prototype actually appears to be Object.prototype.
Comment 1 Kent Hansen 2010-01-13 05:51:10 PST
What's happening is that RuntimeObjectImp::getOwnPropertySlot() does not call the base implementation in JSObject when the property can't be found in the instance. Hence, the prototype chain will be followed, and so the __proto__ property of the prototype (Object.prototype) is returned, whose value is null.

Should getOwnPropertySlot() call the base implementation if the property is not found in the instance? Same issue with RuntimeObjectImp::put(); currently, writes to non-plugin-defined properties (such as __proto__) will be swallowed, since the default implementation of Instance::put() does nothing. Reimplementations of Instance::setValueOfUndefinedField() already have a chance to handle writes to non-existent properties, so could any badness possibly result from calling JSObject::put() if setValueOfUndefinedField() doesn't handle the write?

A less intrusive fix would be to special-case __proto__ access in RuntimeObjectImp, but then the cycle check from JSObject::put() must also be performed.