Lock the prototype of internal classes.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 281c507f5a6d6e83b4dd196e3170a0538950fa33..a947bf9de98ef2b0c06b3a8e6a21680a47b289f7 100644
--- a/src/array.js
+++ b/src/array.js
@@ -1315,6 +1315,7 @@ function ArrayIsArray(obj) {
 
 // -------------------------------------------------------------------
 function SetupArray() {
+  %AssertIsBootstrapping();
   // Setup non-enumerable constructor property on the Array.prototype

[Erik Corry, 2011/08/31 05:46:04]

While we are here:  "Set up", the verb, is two words.  "Setup", the noun, is one
word.  This is several places in the comments and also SetupArray -> SetUpArray.

[Lasse Reichstein, 2011/09/01 13:30:42]

Fixed in comments.

   // object.
   %SetProperty($Array.prototype, "constructor", $Array, DONT_ENUM);
@@ -1368,18 +1369,13 @@ function SetupArray() {
   %FinishArrayPrototypeSetup($Array.prototype);
 
   // The internal Array prototype doesn't need to be fancy, since it's never
-  // exposed to user code, so no hidden prototypes or DONT_ENUM attributes
-  // are necessary.
-  // The null __proto__ ensures that we never inherit any user created
-  // getters or setters from, e.g., Object.prototype.
-  InternalArray.prototype.__proto__ = null;
-  // Adding only the functions that are actually used, and a toString.
-  InternalArray.prototype.join = getFunction("join", ArrayJoin);
-  InternalArray.prototype.pop = getFunction("pop", ArrayPop);
-  InternalArray.prototype.push = getFunction("push", ArrayPush);
-  InternalArray.prototype.toString = function() {
-    return "Internal Array, length " + this.length;
-  };
+  // exposed to user code.
+  // Adding only the functions that are actually used.
+  SetupLockedPrototype(InternalArray, $Array(), $Array(

[Lasse Reichstein, 2011/09/01 13:30:42]

Changed to SetUp....

+    "join", getFunction("join", ArrayJoin),
+    "pop", getFunction("pop", ArrayPop),
+    "push", getFunction("push", ArrayPush)
+  ));
 }