Bug 65832 - Non-extensibility does not prevent mutating [[Prototype]]
Summary: Non-extensibility does not prevent mutating [[Prototype]]
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Major
Assignee: Oliver Hunt
URL: http://es5.github.com/#x8.6.2
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-07 15:15 PDT by Mark S. Miller
Modified: 2012-02-12 14:20 PST (History)
3 users (show)

See Also:

Attachments
Patch (4.10 KB, patch)
2011-08-08 11:59 PDT, Oliver Hunt 		barraclough: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mark S. Miller 2011-08-07 15:15:00 PDT 
ES5.1 section 8.6.2 states:

"In addition, if [[Extensible]] is false the value of the [[Class]] and [[Prototype]] internal properties of the object may not be modified."

However, on Safari 5.0.6 through WebKit Nightly 5.0.6 (5533.22.3, r92569), we see:

> var x = Object.freeze({});
> var y = {};
> x.__proto__ = y;
Object
> y.isPrototypeOf(x);
true
> Object.getPrototypeOf(x) === y;
true

I'm classifying this as Severity=Major, since it is the only currently known showstopper preventing SES from being able to run securely using a verification-only strategy.
Comment 1 Oliver Hunt 2011-08-08 11:59:36 PDT 
Created attachment 103271 [details]
Patch
Comment 2 Oliver Hunt 2011-08-08 12:10:37 PDT 
Committed r92618: <http://trac.webkit.org/changeset/92618>
Comment 3 Mark S. Miller 2012-02-12 14:20:20 PST 
See https://bugs.webkit.org/show_bug.cgi?id=78438