Make sure that we can't access hidden properties by installing accessors on Object.prototype.

test/cctest/test-api.cc

Index: test/cctest/test-api.cc
===================================================================
--- test/cctest/test-api.cc	(revision 9417)
+++ test/cctest/test-api.cc	(working copy)
@@ -1810,6 +1810,34 @@
 }
 
 
+THREADED_TEST(Regress97784) {
+  // Regression test for crbug.com/97784
+  // Messing with the Object.prototype should not have effect on
+  // hidden properties.
+  v8::HandleScope scope;
+  LocalContext env;
+
+  v8::Local<v8::Object> obj = v8::Object::New();
+  v8::Local<v8::String> key = v8_str("hidden");
+
+  CompileRun(
+      "set_called = false;"
+      "Object.defineProperty("
+      "    Object.prototype,"
+      "    'hidden',"
+      "    {get: function() { return 45; },"
+      "     set: function() { set_called = true; }})");
+
+  CHECK(obj->GetHiddenValue(key).IsEmpty());
+  // Make sure that the getter and setter from Object.prototype is not invoked.
+  // If it did we would have full access to the hidden properties in
+  // the accessor.
+  CHECK(obj->SetHiddenValue(key, v8::Integer::New(42)));
+  ExpectFalse("set_called");
+  CHECK_EQ(42, obj->GetHiddenValue(key)->Int32Value());

[Lasse Reichstein, 2011/09/26 13:02:21]

Should we prevent people from doing SetHiddenValue("__proto__", ...) ? 

We really, really shouldn't have used an Object to store the properties if a
plain Dictionary could have done the job. This is not the first time we have
used an object for internal book-keeping, and got caught by acessors on
Object.prototype.

[Rico, 2011/09/26 13:09:48]

As discussed offline, we should, but the real long term solution is to use a
dictionary instead of an object for storing these hidden properties. Since this
is a bug fix I am leaving as is for now.

+}
+
+
 static bool interceptor_for_hidden_properties_called;
 static v8::Handle<Value> InterceptorForHiddenProperties(
     Local<String> name, const AccessorInfo& info) {