Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1123)

Unified Diff: src/v8natives.js

Issue 11364237: When using an Object as a set in Object.getOwnPropertyNames, null out the proto (Closed) Base URL: http://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Apply same fix elsewhere Created 8 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-2410.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index 20fc74dc440dcf28dd64ece1de30133611aadf0b..83de94aa56c2c208819096597ff9b56754b51b95 100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -970,7 +970,7 @@ function ToStringArray(obj, trap) {
}
var n = ToUint32(obj.length);
var array = new $Array(n);
- var names = {}; // TODO(rossberg): use sets once they are ready.
+ var names = { __proto__: null }; // TODO(rossberg): use sets once they are ready.
rossberg 2012/11/15 15:39:37 Actually, this case was correct. ;) But cannot ha
for (var index = 0; index < n; index++) {
var s = ToString(obj[index]);
if (%HasLocalProperty(names, s)) {
@@ -1025,7 +1025,7 @@ function ObjectGetOwnPropertyNames(obj) {
}
// Property names are expected to be unique strings.
- var propertySet = {};
+ var propertySet = { __proto__: null };
var j = 0;
for (var i = 0; i < propertyNames.length; ++i) {
var name = ToString(propertyNames[i]);
@@ -1066,7 +1066,7 @@ function ObjectDefineProperty(obj, p, attributes) {
// Clone the attributes object for protection.
// TODO(rossberg): not spec'ed yet, so not sure if this should involve
// non-own properties as it does (or non-enumerable ones, as it doesn't?).
- var attributesClone = {};
+ var attributesClone = { __proto__: null };
for (var a in attributes) {
attributesClone[a] = attributes[a];
}
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-2410.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698