Fix: FunctionTemplate::SetPrototypeAttributes broke prototype object

src/apinatives.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 56 matching lines @@
   var isFunctionCached =
    (serialNumber in cache) && (cache[serialNumber] != kUninitialized);
   if (!isFunctionCached) {
     try {
       cache[serialNumber] = null;
       var fun = %CreateApiFunction(data);
       if (name) %FunctionSetName(fun, name);
       cache[serialNumber] = fun;
       var prototype = %GetTemplateField(data, kApiPrototypeTemplateOffset);
       var attributes = %GetTemplateField(data, kApiPrototypeAttributesOffset);
+      fun.prototype = prototype ? Instantiate(prototype) : {};
       if (attributes != NONE) {
-        %IgnoreAttributesAndSetProperty(
-            fun, "prototype",
-            prototype ? Instantiate(prototype) : {},
-            attributes);
-      } else {
-        fun.prototype = prototype ? Instantiate(prototype) : {};
+        // This will fail to set the prototype (so we can just pass in '{}'),
+        // but it *will* set its attributes :-)
+        %IgnoreAttributesAndSetProperty(fun, "prototype", {}, attributes);

[Mads Ager (chromium), 2011/07/11 10:12:54]

Let's create a runtime function %SetPropertyAttributes that changes the
attributes of a property after the fact instead of using this one.

The issue here is that the prototype property is not a normal property but an
accessor that extracts the value from a field in the map. How does the code you
had before fail?

       }
       %SetProperty(fun.prototype, "constructor", fun, DONT_ENUM);
       var parent = %GetTemplateField(data, kApiParentTemplateOffset);
       if (parent) {
         var parent_fun = Instantiate(parent);
         fun.prototype.__proto__ = parent_fun.prototype;
       }
       ConfigureTemplateInstance(fun, data);
     } catch (e) {
       cache[serialNumber] = kUninitialized;
@@ skipping 15 matching lines @@
         var prop_data = properties[i + 2];
         var attributes = properties[i + 3];
         var value = Instantiate(prop_data, name);
         %SetProperty(obj, name, value, attributes);
       }
     } finally {
       if (requires_access_checks) %EnableAccessChecks(obj);
     }
   }
 }