Add access checks to Object.preventExtensions + add regression test for 1027....

src/runtime.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 863 matching lines @@
     elms->set(VALUE_INDEX, value);
   }
 
   return *desc;
 }
 
 
 static MaybeObject* Runtime_PreventExtensions(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(JSObject, obj, args[0]);
+
+  if (obj->IsJSGlobalProxy()) {
+    // If access checks fail simply return false

[antonm, 2011/02/17 15:44:12]

nit: dot at the end, please

[Rico, 2011/02/18 07:49:09]

Done.

+    if (obj->IsAccessCheckNeeded() &&

[antonm, 2011/02/17 15:44:12]

Do we want access checks only on the proxy?  Why not on the global object also? 
Is there something special about these queries?

I am asking as apparently the common approach is to do something like that:

Foo(obj)
 // security check for obj.
 if (obj->IsJSGlobalProx()) {
  return Foo(obj->GetPrototype())
 }
 // Real logic

+        !Top::MayNamedAccess(obj, Heap::undefined_value(), v8::ACCESS_KEYS)) {
+      Top::ReportFailedAccessCheck(obj, v8::ACCESS_KEYS);
+      return Heap::false_value();
+    }
+    obj = JSObject::cast(obj->GetPrototype());
+  }
+
   return obj->PreventExtensions();
 }
 
 
 static MaybeObject* Runtime_IsExtensible(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(JSObject, obj, args[0]);
   if (obj->IsJSGlobalProxy()) {
     Object* proto = obj->GetPrototype();
     if (proto->IsNull()) return Heap::false_value();
@@ skipping 2772 matching lines @@
   uint32_t index;
   bool is_element = name->AsArrayIndex(&index);
 
   // Special case for elements if any of the flags are true.
   // If elements are in fast case we always implicitly assume that:
   // DONT_DELETE: false, DONT_ENUM: false, READ_ONLY: false.
   if (((unchecked & (DONT_DELETE | DONT_ENUM | READ_ONLY)) != 0) &&
       is_element) {
     // Normalize the elements to enable attributes on the property.
     if (js_object->IsJSGlobalProxy()) {
+      // We do not need to do access checks here since these has already
+      // been performed by the call to GetOwnProperty.
       Handle<Object> proto(js_object->GetPrototype());
       // If proxy is detached, ignore the assignment. Alternatively,
       // we could throw an exception.
       if (proto->IsNull()) return *obj_value;
       js_object = Handle<JSObject>::cast(proto);
     }
     NormalizeElements(js_object);
     Handle<NumberDictionary> dictionary(js_object->element_dictionary());
     // Make sure that we never go back to fast case.
     dictionary->set_requires_slow_elements();
@@ skipping 7515 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     Counters::gc_last_resort_from_js.Increment();
     Heap::CollectAllGarbage(false);
   }
 }
 
 
 } }  // namespace v8::internal