Lock the prototype of internal classes.

src/v8natives.js

Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index 035fd2e2be11bc11679e936031377cb2699c82f4..237cc44a0ea6fa2a8d0f4e3fa98bbdc7cdd1fff7 100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -66,12 +66,37 @@ function InstallFunctions(object, attributes, functions) {
 // functions on String.prototype etc. and then restore the old function
 // with delete.  See http://code.google.com/p/chromium/issues/detail?id=1717
 function InstallFunctionsOnHiddenPrototype(object, attributes, functions) {
+  %AssertIsBootstrapping();
   var hidden_prototype = new $Object();
   %SetHiddenPrototype(object, hidden_prototype);
   InstallFunctions(hidden_prototype, attributes, functions);
 }
 
 
+// Prevents changes to the prototype of a built-infunction.
+// The "prototype" property of the function object is made non-configurable,
+// and the prototype object is made non-extensible. The latter prevents
+// changing the __proto__ property.
+function SetupLockedPrototype(constructor, fields, methods) {
+  %AssertIsBootstrapping();
+  var prototype = constructor.prototype;
+  // Install functions first, because this function is used to initialize
+  // PropertyDescriptor itself.
+  InstallFunctions(prototype, DONT_DELETE | DONT_ENUM | READ_ONLY, methods);
+  if (fields) {
+    for (var i = 0; i < fields.length; i++) {
+      %SetProperty(prototype, fields[i], void 0, DONT_ENUM | DONT_DELETE);
+    }
+  }
+  var desc = GetOwnProperty(constructor, "prototype");
+  desc.setWritable(false);
+  desc.setConfigurable(false);
+  DefineOwnProperty(constructor, "prototype", desc, false);
+  prototype.__proto__ = null;
+  %PreventExtensions(prototype);
+}
+
+
 // ----------------------------------------------------------------------------
 
 
@@ -161,6 +186,7 @@ function GlobalEval(x) {
 
 
 function SetupGlobal() {

[Erik Corry, 2011/08/31 05:46:04]

SetUpGlobal

+  %AssertIsBootstrapping();
   // ECMA 262 - 15.1.1.1.
   %SetProperty(global, "NaN", $NaN, DONT_ENUM | DONT_DELETE);
 
@@ -478,106 +504,83 @@ function PropertyDescriptor() {
   this.hasSetter_ = false;
 }
 
-PropertyDescriptor.prototype.__proto__ = null;
-
-PropertyDescriptor.prototype.toString = function() {
-  return "[object PropertyDescriptor]";
-};
-
-PropertyDescriptor.prototype.setValue = function(value) {
-  this.value_ = value;
-  this.hasValue_ = true;
-}
-
-
-PropertyDescriptor.prototype.getValue = function() {
-  return this.value_;
-}
-
-
-PropertyDescriptor.prototype.hasValue = function() {
-  return this.hasValue_;
-}
-
-
-PropertyDescriptor.prototype.setEnumerable = function(enumerable) {
-  this.enumerable_ = enumerable;
-  this.hasEnumerable_ = true;
-}
-
-
-PropertyDescriptor.prototype.isEnumerable = function () {
-  return this.enumerable_;
-}
-
-
-PropertyDescriptor.prototype.hasEnumerable = function() {
-  return this.hasEnumerable_;
-}
-
-
-PropertyDescriptor.prototype.setWritable = function(writable) {
-  this.writable_ = writable;
-  this.hasWritable_ = true;
-}
-
-
-PropertyDescriptor.prototype.isWritable = function() {
-  return this.writable_;
-}
-
-
-PropertyDescriptor.prototype.hasWritable = function() {
-  return this.hasWritable_;
-}
-
-
-PropertyDescriptor.prototype.setConfigurable = function(configurable) {
-  this.configurable_ = configurable;
-  this.hasConfigurable_ = true;
-}
-
-
-PropertyDescriptor.prototype.hasConfigurable = function() {
-  return this.hasConfigurable_;
-}
-
-
-PropertyDescriptor.prototype.isConfigurable = function() {
-  return this.configurable_;
-}
-
-
-PropertyDescriptor.prototype.setGet = function(get) {
-  this.get_ = get;
-  this.hasGetter_ = true;
-}
-
-
-PropertyDescriptor.prototype.getGet = function() {
-  return this.get_;
-}
-
-
-PropertyDescriptor.prototype.hasGetter = function() {
-  return this.hasGetter_;
-}
-
-
-PropertyDescriptor.prototype.setSet = function(set) {
-  this.set_ = set;
-  this.hasSetter_ = true;
-}
-
-
-PropertyDescriptor.prototype.getSet = function() {
-  return this.set_;
-}
-
-
-PropertyDescriptor.prototype.hasSetter = function() {
-  return this.hasSetter_;
-}
+SetupLockedPrototype(PropertyDescriptor, $Array(

[Erik Corry, 2011/08/31 05:46:04]

SetUpLockedPrototype

+  "value_",
+  "hasValue_",
+  "writable_",
+  "hasWritable_",
+  "enumerable_",
+  "hasEnumerable_",
+  "configurable_",
+  "hasConfigurable_",
+  "get_",
+  "hasGetter_",
+  "set_",
+  "hasSetter_"
+  ), $Array(
+  "toString", function() {
+    return "[object PropertyDescriptor]";
+  },
+  "setValue", function(value) {
+    this.value_ = value;
+    this.hasValue_ = true;
+  },
+  "getValue", function() {
+    return this.value_;
+  },
+  "hasValue", function() {
+    return this.hasValue_;
+  },
+  "setEnumerable", function(enumerable) {
+    this.enumerable_ = enumerable;
+      this.hasEnumerable_ = true;
+  },
+  "isEnumerable", function () {
+    return this.enumerable_;
+  },
+  "hasEnumerable", function() {
+    return this.hasEnumerable_;
+  },
+  "setWritable", function(writable) {
+    this.writable_ = writable;
+    this.hasWritable_ = true;
+  },
+  "isWritable", function() {
+    return this.writable_;
+  },
+  "hasWritable", function() {
+    return this.hasWritable_;
+  },
+  "setConfigurable", function(configurable) {
+    this.configurable_ = configurable;
+    this.hasConfigurable_ = true;
+  },
+  "hasConfigurable", function() {
+    return this.hasConfigurable_;
+  },
+  "isConfigurable", function() {
+    return this.configurable_;
+  },
+  "setGet", function(get) {
+    this.get_ = get;
+      this.hasGetter_ = true;
+  },
+  "getGet", function() {
+    return this.get_;
+  },
+  "hasGetter", function() {
+    return this.hasGetter_;
+  },
+  "setSet", function(set) {
+    this.set_ = set;
+    this.hasSetter_ = true;
+  },
+  "getSet", function() {
+    return this.set_;
+  },
+  "hasSetter", function() {
+    return this.hasSetter_;
+  }));
 
 
 // Converts an array returned from Runtime_GetOwnProperty to an actual
@@ -1168,6 +1171,7 @@ function ObjectIsExtensible(obj) {
 
 
 function SetupObject() {

[Erik Corry, 2011/08/31 05:46:04]

SetUpObject

+  %AssertIsBootstrapping();
   // Setup non-enumerable functions on the Object.prototype object.
   InstallFunctions($Object.prototype, DONT_ENUM, $Array(
     "toString", ObjectToString,
@@ -1231,6 +1235,7 @@ function BooleanValueOf() {
 
 
 function SetupBoolean() {

[Erik Corry, 2011/08/31 05:46:04]

SetUpBoolean

+  %AssertIsBootstrapping();
   InstallFunctions($Boolean.prototype, DONT_ENUM, $Array(
     "toString", BooleanToString,
     "valueOf", BooleanValueOf
@@ -1352,6 +1357,7 @@ function NumberToPrecision(precision) {
 // ----------------------------------------------------------------------------
 
 function SetupNumber() {
+  %AssertIsBootstrapping();

[Erik Corry, 2011/08/31 05:46:04]

SetUpNumber

   %OptimizeObjectForAddingMultipleProperties($Number.prototype, 8);
   // Setup the constructor property on the Number prototype object.
   %SetProperty($Number.prototype, "constructor", $Number, DONT_ENUM);
@@ -1523,6 +1529,7 @@ function NewFunction(arg1) {  // length == 1
 // ----------------------------------------------------------------------------
 
 function SetupFunction() {
+  %AssertIsBootstrapping();

[Erik Corry, 2011/08/31 05:46:04]

SetUpFunction

   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString