Lock the prototype of internal classes.

src/array.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1297 matching lines @@
 }
 
 // ES5, 15.4.3.2
 function ArrayIsArray(obj) {
   return IS_ARRAY(obj);
 }
 
 
 // -------------------------------------------------------------------
 function SetupArray() {
+  %AssertIsBootstrapping();
   // Setup non-enumerable constructor property on the Array.prototype

[Erik Corry, 2011/08/31 05:46:04]

While we are here:  "Set up", the verb, is two words.  "Setup", the noun, is one
word.  This is several places in the comments and also SetupArray -> SetUpArray.

[Lasse Reichstein, 2011/09/01 13:30:42]

Fixed in comments.

   // object.
   %SetProperty($Array.prototype, "constructor", $Array, DONT_ENUM);
 
   // Setup non-enumerable functions on the Array object.
   InstallFunctions($Array, DONT_ENUM, $Array(
     "isArray", ArrayIsArray
   ));
 
   var specialFunctions = %SpecialArrayFunctions({});
 
@@ skipping 32 matching lines @@
     "map", getFunction("map", ArrayMap, 1),
     "indexOf", getFunction("indexOf", ArrayIndexOf, 1),
     "lastIndexOf", getFunction("lastIndexOf", ArrayLastIndexOf, 1),
     "reduce", getFunction("reduce", ArrayReduce, 1),
     "reduceRight", getFunction("reduceRight", ArrayReduceRight, 1)
   ));
 
   %FinishArrayPrototypeSetup($Array.prototype);
 
   // The internal Array prototype doesn't need to be fancy, since it's never
-  // exposed to user code, so no hidden prototypes or DONT_ENUM attributes
-  // are necessary.
-  // The null __proto__ ensures that we never inherit any user created
-  // getters or setters from, e.g., Object.prototype.
-  InternalArray.prototype.__proto__ = null;
-  // Adding only the functions that are actually used, and a toString.
-  InternalArray.prototype.join = getFunction("join", ArrayJoin);
-  InternalArray.prototype.pop = getFunction("pop", ArrayPop);
-  InternalArray.prototype.push = getFunction("push", ArrayPush);
-  InternalArray.prototype.toString = function() {
-    return "Internal Array, length " + this.length;
-  };
+  // exposed to user code.
+  // Adding only the functions that are actually used.
+  SetupLockedPrototype(InternalArray, $Array(), $Array(

[Lasse Reichstein, 2011/09/01 13:30:42]

Changed to SetUp....

+    "join", getFunction("join", ArrayJoin),
+    "pop", getFunction("pop", ArrayPop),
+    "push", getFunction("push", ArrayPush)
+  ));
 }
 
 
 SetupArray();