Make sure that we can't access hidden properties by installing accessors on Object.prototype.

test/cctest/test-api.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1792 matching lines @@
   CHECK(obj->Delete(prop_name));
   CHECK_EQ(2002, obj->GetHiddenValue(key)->Int32Value());
 
   HEAP->CollectAllGarbage(i::Heap::kNoGCFlags);
 
   CHECK(obj->DeleteHiddenValue(key));
   CHECK(obj->GetHiddenValue(key).IsEmpty());
 }
 
 
+THREADED_TEST(Regress97784) {
+  // Regression test for crbug.com/97784
+  // Messing with the Object.prototype should not have effect on
+  // hidden properties.
+  v8::HandleScope scope;
+  LocalContext env;
+
+  v8::Local<v8::Object> obj = v8::Object::New();
+  v8::Local<v8::String> key = v8_str("hidden");
+
+  CompileRun(
+      "set_called = false;"
+      "Object.defineProperty("
+      "    Object.prototype,"
+      "    'hidden',"
+      "    {get: function() { return 45; },"
+      "     set: function() { set_called = true; }})");
+
+  CHECK(obj->GetHiddenValue(key).IsEmpty());
+  // Make sure that the getter and setter from Object.prototype is not invoked.
+  // If it did we would have full access to the hidden properties in
+  // the accessor.
+  CHECK(obj->SetHiddenValue(key, v8::Integer::New(42)));
+  ExpectFalse("set_called");
+  CHECK_EQ(42, obj->GetHiddenValue(key)->Int32Value());

[Lasse Reichstein, 2011/09/26 13:02:21]

Should we prevent people from doing SetHiddenValue("__proto__", ...) ? 

We really, really shouldn't have used an Object to store the properties if a
plain Dictionary could have done the job. This is not the first time we have
used an object for internal book-keeping, and got caught by acessors on
Object.prototype.

[Rico, 2011/09/26 13:09:48]

As discussed offline, we should, but the real long term solution is to use a
dictionary instead of an object for storing these hidden properties. Since this
is a bug fix I am leaving as is for now.

+}
+
+
 static bool interceptor_for_hidden_properties_called;
 static v8::Handle<Value> InterceptorForHiddenProperties(
     Local<String> name, const AccessorInfo& info) {
   interceptor_for_hidden_properties_called = true;
   return v8::Handle<Value>();
 }
 
 
 THREADED_TEST(HiddenPropertiesWithInterceptors) {
   v8::HandleScope scope;
@@ skipping 13386 matching lines @@
   CHECK(i->Equals(CompileRun("'abcbd'.replace(/b/g,func)[3]")));
 
   // TODO(1547): Make the following also return "i".
   // Calling with environment record as base.
   TestReceiver(o, context->Global(), "func()");
   // Calling with no base.
   TestReceiver(o, context->Global(), "(1,func)()");
 
   foreign_context.Dispose();
 }