When using an Object as a set in Object.getOwnPropertyNames, null out the proto

src/v8natives.js

Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index 20fc74dc440dcf28dd64ece1de30133611aadf0b..83de94aa56c2c208819096597ff9b56754b51b95 100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -970,7 +970,7 @@ function ToStringArray(obj, trap) {
   }
   var n = ToUint32(obj.length);
   var array = new $Array(n);
-  var names = {};  // TODO(rossberg): use sets once they are ready.
+  var names = { __proto__: null };  // TODO(rossberg): use sets once they are ready.

[rossberg, 2012/11/15 15:39:37]

Actually, this case was correct. ;)  But cannot harm either.

I'll fix the line length.

   for (var index = 0; index < n; index++) {
     var s = ToString(obj[index]);
     if (%HasLocalProperty(names, s)) {
@@ -1025,7 +1025,7 @@ function ObjectGetOwnPropertyNames(obj) {
   }
 
   // Property names are expected to be unique strings.
-  var propertySet = {};
+  var propertySet = { __proto__: null };
   var j = 0;
   for (var i = 0; i < propertyNames.length; ++i) {
     var name = ToString(propertyNames[i]);
@@ -1066,7 +1066,7 @@ function ObjectDefineProperty(obj, p, attributes) {
     // Clone the attributes object for protection.
     // TODO(rossberg): not spec'ed yet, so not sure if this should involve
     // non-own properties as it does (or non-enumerable ones, as it doesn't?).
-    var attributesClone = {};
+    var attributesClone = { __proto__: null };
     for (var a in attributes) {
       attributesClone[a] = attributes[a];
     }