Introduce access control in propertyIsEnumerable....

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 620)
+++ src/objects.cc	(working copy)
@@ -266,6 +266,55 @@
 }
 
 
+PropertyAttributes JSObject::GetPropertyAttributeWithFailedAccessCheck(
+  Object* receiver,

[Mads Ager (chromium), 2008/10/28 20:02:38]

Parameters should be indented by four spaces instead of two.

+  LookupResult* result,
+  String* name) {
+  if (result->IsValid()) {
+    switch (result->type()) {
+      case CALLBACKS: {
+        // Only allow API accessors.
+        Object* obj = result->GetCallbackObject();
+        if (obj->IsAccessorInfo()) {
+          AccessorInfo* info = AccessorInfo::cast(obj);
+          if (info->all_can_read()) {
+            return result->GetAttributes();
+          }
+        }
+        break;
+      }
+      case NORMAL:
+      case FIELD:
+      case CONSTANT_FUNCTION: {

[Mads Ager (chromium), 2008/10/28 20:02:38]

I think you might have to pass in a boolean indicating whether or not to search
the prototype chain.  The ECMA-262 standard says that propertyIsEnumerable does
not take the prototype chain into account (note to section 15.2.4.7), so we
probably should not search for accessors in the prototype chain in that case.

+        // Search ALL_CAN_READ accessors in prototype chain.
+        LookupResult r;
+        result->holder()->LookupRealNamedPropertyInPrototypes(name, &r);
+        if (r.IsValid()) {
+          return GetPropertyAttributeWithFailedAccessCheck(receiver, &r, name);
+        }
+        break;
+      }
+      case INTERCEPTOR: {
+        // If the object has an interceptor, try real named properties.
+        // No access check in GetPropertyAttributeWithInterceptor.
+        LookupResult r;
+        result->holder()->LookupRealNamedProperty(name, &r);

[Mads Ager (chromium), 2008/10/28 20:02:38]

Similarly here, we probably need the boolean indicating whether or not to search
the prototype chain.  That is, whether this should be a LookupRealNamedProperty
or only a LocalLookupRealNamedProperty.

+        if (r.IsValid()) {
+          return GetPropertyAttributeWithFailedAccessCheck(receiver, &r, name);
+        }
+        break;
+      }
+      default: {
+        break;
+      }
+    }
+  }
+
+  Top::ReportFailedAccessCheck(this, v8::ACCESS_GET);
+  return ABSENT;
+}
+
+
 Object* JSObject::GetLazyProperty(Object* receiver,
                                   LookupResult* result,
                                   String* name,
@@ -1720,8 +1769,7 @@
   // Check access rights if needed.
   if (IsAccessCheckNeeded() &&
       !Top::MayNamedAccess(this, name, v8::ACCESS_HAS)) {
-    Top::ReportFailedAccessCheck(this, v8::ACCESS_HAS);
-    return ABSENT;
+    return GetPropertyAttributeWithFailedAccessCheck(receiver, result, name);

[Mads Ager (chromium), 2008/10/28 20:02:38]

I think we need to propagate the continue_search argument here.

   }
   if (result->IsValid()) {
     switch (result->type()) {