Lock the prototype of internal classes.

src/v8natives.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 48 matching lines @@
     %SetNativeFlag(f);
   }
   %ToFastProperties(object);
 }
 
 // Emulates JSC by installing functions on a hidden prototype that
 // lies above the current object/prototype.  This lets you override
 // functions on String.prototype etc. and then restore the old function
 // with delete.  See http://code.google.com/p/chromium/issues/detail?id=1717
 function InstallFunctionsOnHiddenPrototype(object, attributes, functions) {
+  %AssertIsBootstrapping();
   var hidden_prototype = new $Object();
   %SetHiddenPrototype(object, hidden_prototype);
   InstallFunctions(hidden_prototype, attributes, functions);
 }
 
 
+// Prevents changes to the prototype of a built-infunction.
+// The "prototype" property of the function object is made non-configurable,
+// and the prototype object is made non-extensible. The latter prevents
+// changing the __proto__ property.
+function SetupLockedPrototype(constructor, fields, methods) {
+  %AssertIsBootstrapping();
+  var prototype = constructor.prototype;
+  // Install functions first, because this function is used to initialize
+  // PropertyDescriptor itself.
+  InstallFunctions(prototype, DONT_DELETE | DONT_ENUM | READ_ONLY, methods);
+  if (fields) {
+    for (var i = 0; i < fields.length; i++) {
+      %SetProperty(prototype, fields[i], void 0, DONT_ENUM | DONT_DELETE);
+    }
+  }
+  var desc = GetOwnProperty(constructor, "prototype");
+  desc.setWritable(false);
+  desc.setConfigurable(false);
+  DefineOwnProperty(constructor, "prototype", desc, false);
+  prototype.__proto__ = null;
+  %PreventExtensions(prototype);
+}
+
+
 // ----------------------------------------------------------------------------
 
 
 // ECMA 262 - 15.1.4
 function GlobalIsNaN(number) {
   var n = ToNumber(number);
   return NUMBER_IS_NAN(n);
 }
 
 
@@ skipping 68 matching lines @@
   var f = %CompileString(x);
   if (!IS_FUNCTION(f)) return f;
 
   return %_CallFunction(receiver, f);
 }
 
 
 // ----------------------------------------------------------------------------
 
 
 function SetupGlobal() {

[Erik Corry, 2011/08/31 05:46:04]

SetUpGlobal

+  %AssertIsBootstrapping();
   // ECMA 262 - 15.1.1.1.
   %SetProperty(global, "NaN", $NaN, DONT_ENUM | DONT_DELETE);
 
   // ECMA-262 - 15.1.1.2.
   %SetProperty(global, "Infinity", 1/0, DONT_ENUM | DONT_DELETE);
 
   // ECMA-262 - 15.1.1.3.
   %SetProperty(global, "undefined", void 0, DONT_ENUM | DONT_DELETE);
 
   // Setup non-enumerable function on the global object.
@@ skipping 297 matching lines @@
   this.enumerable_ = false;
   this.hasEnumerable_ = false;
   this.configurable_ = false;
   this.hasConfigurable_ = false;
   this.get_ = void 0;
   this.hasGetter_ = false;
   this.set_ = void 0;
   this.hasSetter_ = false;
 }
 
-PropertyDescriptor.prototype.__proto__ = null;
-
-PropertyDescriptor.prototype.toString = function() {
-  return "[object PropertyDescriptor]";
-};
-
-PropertyDescriptor.prototype.setValue = function(value) {
-  this.value_ = value;
-  this.hasValue_ = true;
-}
-
-
-PropertyDescriptor.prototype.getValue = function() {
-  return this.value_;
-}
-
-
-PropertyDescriptor.prototype.hasValue = function() {
-  return this.hasValue_;
-}
-
-
-PropertyDescriptor.prototype.setEnumerable = function(enumerable) {
-  this.enumerable_ = enumerable;
-  this.hasEnumerable_ = true;
-}
-
-
-PropertyDescriptor.prototype.isEnumerable = function () {
-  return this.enumerable_;
-}
-
-
-PropertyDescriptor.prototype.hasEnumerable = function() {
-  return this.hasEnumerable_;
-}
-
-
-PropertyDescriptor.prototype.setWritable = function(writable) {
-  this.writable_ = writable;
-  this.hasWritable_ = true;
-}
-
-
-PropertyDescriptor.prototype.isWritable = function() {
-  return this.writable_;
-}
-
-
-PropertyDescriptor.prototype.hasWritable = function() {
-  return this.hasWritable_;
-}
-
-
-PropertyDescriptor.prototype.setConfigurable = function(configurable) {
-  this.configurable_ = configurable;
-  this.hasConfigurable_ = true;
-}
-
-
-PropertyDescriptor.prototype.hasConfigurable = function() {
-  return this.hasConfigurable_;
-}
-
-
-PropertyDescriptor.prototype.isConfigurable = function() {
-  return this.configurable_;
-}
-
-
-PropertyDescriptor.prototype.setGet = function(get) {
-  this.get_ = get;
-  this.hasGetter_ = true;
-}
-
-
-PropertyDescriptor.prototype.getGet = function() {
-  return this.get_;
-}
-
-
-PropertyDescriptor.prototype.hasGetter = function() {
-  return this.hasGetter_;
-}
-
-
-PropertyDescriptor.prototype.setSet = function(set) {
-  this.set_ = set;
-  this.hasSetter_ = true;
-}
-
-
-PropertyDescriptor.prototype.getSet = function() {
-  return this.set_;
-}
-
-
-PropertyDescriptor.prototype.hasSetter = function() {
-  return this.hasSetter_;
-}
+SetupLockedPrototype(PropertyDescriptor, $Array(

[Erik Corry, 2011/08/31 05:46:04]

SetUpLockedPrototype

+  "value_",
+  "hasValue_",
+  "writable_",
+  "hasWritable_",
+  "enumerable_",
+  "hasEnumerable_",
+  "configurable_",
+  "hasConfigurable_",
+  "get_",
+  "hasGetter_",
+  "set_",
+  "hasSetter_"
+  ), $Array(
+  "toString", function() {
+    return "[object PropertyDescriptor]";
+  },
+  "setValue", function(value) {
+    this.value_ = value;
+    this.hasValue_ = true;
+  },
+  "getValue", function() {
+    return this.value_;
+  },
+  "hasValue", function() {
+    return this.hasValue_;
+  },
+  "setEnumerable", function(enumerable) {
+    this.enumerable_ = enumerable;
+      this.hasEnumerable_ = true;
+  },
+  "isEnumerable", function () {
+    return this.enumerable_;
+  },
+  "hasEnumerable", function() {
+    return this.hasEnumerable_;
+  },
+  "setWritable", function(writable) {
+    this.writable_ = writable;
+    this.hasWritable_ = true;
+  },
+  "isWritable", function() {
+    return this.writable_;
+  },
+  "hasWritable", function() {
+    return this.hasWritable_;
+  },
+  "setConfigurable", function(configurable) {
+    this.configurable_ = configurable;
+    this.hasConfigurable_ = true;
+  },
+  "hasConfigurable", function() {
+    return this.hasConfigurable_;
+  },
+  "isConfigurable", function() {
+    return this.configurable_;
+  },
+  "setGet", function(get) {
+    this.get_ = get;
+      this.hasGetter_ = true;
+  },
+  "getGet", function() {
+    return this.get_;
+  },
+  "hasGetter", function() {
+    return this.hasGetter_;
+  },
+  "setSet", function(set) {
+    this.set_ = set;
+    this.hasSetter_ = true;
+  },
+  "getSet", function() {
+    return this.set_;
+  },
+  "hasSetter", function() {
+    return this.hasSetter_;
+  }));
 
 
 // Converts an array returned from Runtime_GetOwnProperty to an actual
 // property descriptor. For a description of the array layout please
 // see the runtime.cc file.
 function ConvertDescriptorArrayToDescriptor(desc_array) {
   if (desc_array === false) {
     throw 'Internal error: invalid desc_array';
   }
 
@@ skipping 569 matching lines @@
     if (x == null) return { };
     return ToObject(x);
   }
 });
 
 %SetExpectedNumberOfProperties($Object, 4);
 
 // ----------------------------------------------------------------------------
 
 
 function SetupObject() {

[Erik Corry, 2011/08/31 05:46:04]

SetUpObject

+  %AssertIsBootstrapping();
   // Setup non-enumerable functions on the Object.prototype object.
   InstallFunctions($Object.prototype, DONT_ENUM, $Array(
     "toString", ObjectToString,
     "toLocaleString", ObjectToLocaleString,
     "valueOf", ObjectValueOf,
     "hasOwnProperty", ObjectHasOwnProperty,
     "isPrototypeOf", ObjectIsPrototypeOf,
     "propertyIsEnumerable", ObjectPropertyIsEnumerable,
     "__defineGetter__", ObjectDefineGetter,
     "__lookupGetter__", ObjectLookupGetter,
@@ skipping 42 matching lines @@
   // 'this'. This is not as dictated by ECMA-262.
   if (!IS_BOOLEAN(this) && !IS_BOOLEAN_WRAPPER(this))
     throw new $TypeError('Boolean.prototype.valueOf is not generic');
   return %_ValueOf(this);
 }
 
 
 // ----------------------------------------------------------------------------
 
 
 function SetupBoolean() {

[Erik Corry, 2011/08/31 05:46:04]

SetUpBoolean

+  %AssertIsBootstrapping();
   InstallFunctions($Boolean.prototype, DONT_ENUM, $Array(
     "toString", BooleanToString,
     "valueOf", BooleanValueOf
   ));
 }
 
 SetupBoolean();
 
 // ----------------------------------------------------------------------------
 // Number
@@ skipping 101 matching lines @@
     throw new $RangeError("toPrecision() argument must be between 1 and 21");
   }
   var x = ToNumber(this);
   return %NumberToPrecision(x, p);
 }
 
 
 // ----------------------------------------------------------------------------
 
 function SetupNumber() {
+  %AssertIsBootstrapping();

[Erik Corry, 2011/08/31 05:46:04]

SetUpNumber

   %OptimizeObjectForAddingMultipleProperties($Number.prototype, 8);
   // Setup the constructor property on the Number prototype object.
   %SetProperty($Number.prototype, "constructor", $Number, DONT_ENUM);
 
   %OptimizeObjectForAddingMultipleProperties($Number, 5);
   // ECMA-262 section 15.7.3.1.
   %SetProperty($Number,
                "MAX_VALUE",
                1.7976931348623157e+308,
                DONT_ENUM | DONT_DELETE | READ_ONLY);
@@ skipping 151 matching lines @@
   var f = %CompileString(source)();
   %FunctionMarkNameShouldPrintAsAnonymous(f);
   return %SetNewFunctionAttributes(f);
 }
 
 %SetCode($Function, NewFunction);
 
 // ----------------------------------------------------------------------------
 
 function SetupFunction() {
+  %AssertIsBootstrapping();

[Erik Corry, 2011/08/31 05:46:04]

SetUpFunction

   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString
   ));
 }
 
 SetupFunction();