When using an Object as a set in Object.getOwnPropertyNames, null out the proto

src/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1007 matching lines @@
 
   if (%GetInterceptorInfo(obj) & 2) {
     var namedInterceptorNames =
         %GetNamedInterceptorPropertyNames(obj);
     if (namedInterceptorNames) {
       propertyNames = propertyNames.concat(namedInterceptorNames);
     }
   }
 
   // Property names are expected to be unique strings.
-  var propertySet = {};
+  var propertySet = { __proto__: null };
   var j = 0;
   for (var i = 0; i < propertyNames.length; ++i) {
     var name = ToString(propertyNames[i]);
     // We need to check for the exact property value since for intrinsic
     // properties like toString if(propertySet["toString"]) will always
     // succeed.
     if (propertySet[name] === true) {
       continue;
     }
     propertySet[name] = true;
@@ skipping 20 matching lines @@
 // ES5 section 15.2.3.6.
 function ObjectDefineProperty(obj, p, attributes) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.defineProperty"]);
   }
   var name = ToString(p);
   if (%IsJSProxy(obj)) {
     // Clone the attributes object for protection.
     // TODO(rossberg): not spec'ed yet, so not sure if this should involve
     // non-own properties as it does (or non-enumerable ones, as it doesn't?).
     var attributesClone = {};

[rossberg, 2012/11/15 14:23:11]

While you're at it, could you apply the same fix here? :)

[adamk, 2012/11/15 14:33:30]

But then I'd need a test :).  Seems like a separate concern to me (and my Proxy
knowledge at this time in the morning is not so great)...

     for (var a in attributes) {
       attributesClone[a] = attributes[a];
     }
     DefineProxyProperty(obj, name, attributesClone, true);
     // The following would implement the spec as in the current proposal,
     // but after recent comments on es-discuss, is most likely obsolete.
     /*
     var defineObj = FromGenericPropertyDescriptor(desc);
     var names = ObjectGetOwnPropertyNames(attributes);
     var standardNames =
@@ skipping 597 matching lines @@
 
 function SetUpFunction() {
   %CheckIsBootstrapping();
   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString
   ));
 }
 
 SetUpFunction();