[Webkit-unassigned] [Bug 65832] New: Non-extensibility does not prevent mutating [[Prototype]]

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sun Aug 7 15:15:00 PDT 2011


           Summary: Non-extensibility does not prevent mutating
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
               URL: http://es5.github.com/#x8.6.2
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Major
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: erights at gmail.com

ES5.1 section 8.6.2 states:

"In addition, if [[Extensible]] is false the value of the [[Class]] and [[Prototype]] internal properties of the object may not be modified."

However, on Safari 5.0.6 through WebKit Nightly 5.0.6 (5533.22.3, r92569), we see:

> var x = Object.freeze({});
> var y = {};
> x.__proto__ = y;
> y.isPrototypeOf(x);
> Object.getPrototypeOf(x) === y;

I'm classifying this as Severity=Major, since it is the only currently known showstopper preventing SES from being able to run securely using a verification-only strategy.

Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the webkit-unassigned mailing list