[Webkit-unassigned] [Bug 65832] New: Non-extensibility does not prevent mutating [[Prototype]]

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=65832

           Summary: Non-extensibility does not prevent mutating
                    [[Prototype]]
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
               URL: http://es5.github.com/#x8.6.2
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Major
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: erights at gmail.com


ES5.1 section 8.6.2 states:

"In addition, if [[Extensible]] is false the value of the [[Class]] and [[Prototype]] internal properties of the object may not be modified."

However, on Safari 5.0.6 through WebKit Nightly 5.0.6 (5533.22.3, r92569), we see:

> var x = Object.freeze({});
> var y = {};
> x.__proto__ = y;
Object
> y.isPrototypeOf(x);
true
> Object.getPrototypeOf(x) === y;
true

I'm classifying this as Severity=Major, since it is the only currently known showstopper preventing SES from being able to run securely using a verification-only strategy.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.