When using an Object as a set in Object.getOwnPropertyNames, null out the proto

src/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 952 matching lines @@
 }
 
 
 // For Harmony proxies
 function ToStringArray(obj, trap) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("proxy_non_object_prop_names", [obj, trap]);
   }
   var n = ToUint32(obj.length);
   var array = new $Array(n);
-  var names = {};  // TODO(rossberg): use sets once they are ready.
+  var names = { __proto__: null };  // TODO(rossberg): use sets once they are ready.

[rossberg, 2012/11/15 15:39:37]

Actually, this case was correct. ;)  But cannot harm either.

I'll fix the line length.

   for (var index = 0; index < n; index++) {
     var s = ToString(obj[index]);
     if (%HasLocalProperty(names, s)) {
       throw MakeTypeError("proxy_repeated_prop_name", [obj, trap, s]);
     }
     array[index] = s;
     names[s] = 0;
   }
   return array;
 }
@@ skipping 34 matching lines @@
 
   if (%GetInterceptorInfo(obj) & 2) {
     var namedInterceptorNames =
         %GetNamedInterceptorPropertyNames(obj);
     if (namedInterceptorNames) {
       propertyNames = propertyNames.concat(namedInterceptorNames);
     }
   }
 
   // Property names are expected to be unique strings.
-  var propertySet = {};
+  var propertySet = { __proto__: null };
   var j = 0;
   for (var i = 0; i < propertyNames.length; ++i) {
     var name = ToString(propertyNames[i]);
     // We need to check for the exact property value since for intrinsic
     // properties like toString if(propertySet["toString"]) will always
     // succeed.
     if (propertySet[name] === true) {
       continue;
     }
     propertySet[name] = true;
@@ skipping 20 matching lines @@
 // ES5 section 15.2.3.6.
 function ObjectDefineProperty(obj, p, attributes) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.defineProperty"]);
   }
   var name = ToString(p);
   if (%IsJSProxy(obj)) {
     // Clone the attributes object for protection.
     // TODO(rossberg): not spec'ed yet, so not sure if this should involve
     // non-own properties as it does (or non-enumerable ones, as it doesn't?).
-    var attributesClone = {};
+    var attributesClone = { __proto__: null };
     for (var a in attributes) {
       attributesClone[a] = attributes[a];
     }
     DefineProxyProperty(obj, name, attributesClone, true);
     // The following would implement the spec as in the current proposal,
     // but after recent comments on es-discuss, is most likely obsolete.
     /*
     var defineObj = FromGenericPropertyDescriptor(desc);
     var names = ObjectGetOwnPropertyNames(attributes);
     var standardNames =
@@ skipping 597 matching lines @@
 
 function SetUpFunction() {
   %CheckIsBootstrapping();
   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString
   ));
 }
 
 SetUpFunction();