[jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion

[Oliver Hunt]

tryItOut("\"use strict\";h();/**/function h(){(0)}(3);function __proto__(){/j/}\"\"")

Adding function labelled __proto__ triggers a changed prototype transition, which converts the structure into a non-dictionary type, leading to badness.

I'm inclined to simply disallow __proto__ as a variable or function declaration inside eval code.

[Gavin Barraclough]

We should pop up an alert scolding anyone for running code that redefines __proto__.

I'd support disallowing __proto__as a variable or function name in eval code, but it could seem a little arbitrary.  Personally I'd go so far as to disallow it everywhere.

[Oliver Hunt]

Created attachment 79458 [details]
Patch

[Oliver Hunt]

Committed r76148: <http://trac.webkit.org/changeset/76148>