Do not allow accessors to intercept getting/setting properties on...

src/messages.js

Index: src/messages.js
===================================================================
--- src/messages.js	(revision 6270)
+++ src/messages.js	(working copy)
@@ -946,12 +946,18 @@
   f.prototype.name = name;
   %SetCode(f, function(m) {
     if (%_IsConstructCall()) {
+      // Define all the expected properties directly on the error
+      // object. This avoids going through getters and setters defined
+      // on prototype objects.
+      %IgnoreAttributesAndSetProperty(this, 'stack', void 0);
+      %IgnoreAttributesAndSetProperty(this, 'arguments', void 0);
+      %IgnoreAttributesAndSetProperty(this, 'type', void 0);
       if (m === kAddMessageAccessorsMarker) {

[Søren Thygesen Gjesse, 2011/01/12 15:46:41]

Maybe add a comment that DefineOneShotAccessor ensures that there always is a
'message' property set directly on the object.

         DefineOneShotAccessor(this, 'message', function (obj) {
           return FormatMessage({type: obj.type, args: obj.arguments});
         });
       } else if (!IS_UNDEFINED(m)) {
-        this.message = ToString(m);
+        %IgnoreAttributesAndSetProperty(this, 'message', ToString(m));
       }
       captureStackTrace(this, f);
     } else {
@@ -992,8 +998,8 @@
   if (type && !this.hasOwnProperty("message")) {
     return this.name + ": " + FormatMessage({ type: type, args: this.arguments });
   }
-  var message = this.message;
-  return this.name + (message ? (": " + message) : "");
+  var message = this.hasOwnProperty("message") ? (": " + this.message) : "";
+  return this.name + message;
 }, DONT_ENUM);