[Webkit-unassigned] [Bug 33595] __proto__ property of plugin object returns null

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=33595





--- Comment #1 from Kent Hansen <kent.hansen at nokia.com>  2010-01-13 05:51:10 PST ---
What's happening is that RuntimeObjectImp::getOwnPropertySlot() does not call
the base implementation in JSObject when the property can't be found in the
instance. Hence, the prototype chain will be followed, and so the __proto__
property of the prototype (Object.prototype) is returned, whose value is null.

Should getOwnPropertySlot() call the base implementation if the property is not
found in the instance? Same issue with RuntimeObjectImp::put(); currently,
writes to non-plugin-defined properties (such as __proto__) will be swallowed,
since the default implementation of Instance::put() does nothing.
Reimplementations of Instance::setValueOfUndefinedField() already have a chance
to handle writes to non-existent properties, so could any badness possibly
result from calling JSObject::put() if setValueOfUndefinedField() doesn't
handle the write?

A less intrusive fix would be to special-case __proto__ access in
RuntimeObjectImp, but then the cycle check from JSObject::put() must also be
performed.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.