[es6] silence access-check failure for well-known symbol properties

test/cctest/test-api.cc

Index: test/cctest/test-api.cc
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index 2bfdeabd42cd606a40e8242d120465dc0414a0ab..6b27f9c8d4f4df8543580e180acf308b4c8eea5e 100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -21855,3 +21855,61 @@ TEST(CompatibleReceiverCheckOnCachedICHandler) {
       "result;\n",
       0);
 }
+
+
+static bool AccessSymbolsAlwaysBlocked(Local<v8::Object> global,
+                                       Local<Value> name, v8::AccessType type,
+                                       Local<Value> data) {
+  if (!name->IsSymbol()) return true;
+  i::PrintF("Access blocked.\n");
+  return false;
+}
+
+
+THREADED_TEST(Regress507553) {
+  v8::Isolate* isolate = CcTest::isolate();
+  HandleScope scope(isolate);
+
+  // Template for object with security check.
+  Local<ObjectTemplate> spreadable_template = v8::ObjectTemplate::New(isolate);
+  spreadable_template->SetAccessCheckCallbacks(AccessSymbolsAlwaysBlocked,
+                                               NULL);
+
+  // Context for "foreign" objects used in test.
+  Local<Context> context = v8::Context::New(isolate);
+  context->Enter();
+
+  // Object with explicit security check.
+  Local<Object> protected_object = spreadable_template->NewInstance();
+
+  // JSGlobalProxy object, always have security check.
+  Local<Object> proxy_object = context->Global();
+
+  // Global object, the  prototype of proxy_object. No security checks.
+  Local<Object> global_object = proxy_object->GetPrototype()->ToObject(isolate);
+
+  spreadable_template->Set(v8::Symbol::GetIsConcatSpreadable(isolate),
+                           v8::Boolean::New(isolate, true));
+
+  protected_object->Set(v8_str("length"), v8::Integer::New(isolate, 2));
+  protected_object->Set(0U, v8_str("a"));
+  protected_object->Set(1U, v8_str("b"));
+
+  Local<ObjectTemplate> global_template = ObjectTemplate::New(isolate);
+  global_template->Set(v8_str("protected"), protected_object);
+  global_template->Set(v8_str("global"), global_object);
+
+  context->Exit();
+
+  LocalContext context2(NULL, global_template);
+
+  Local<Value> result1 = CompileRun("[].concat(protected)");
+  CHECK(result1->IsArray());
+  CHECK(result1.As<Object>()->Get(0)->Equals(protected_object));
+
+  Local<Value> result2 = CompileRun("[].concat([global, global], protected)");

[caitp (gmail), 2015/07/09 14:49:41]

This is probably not doing what I want it to do

I would like context 1 to attempt to pass an array from context 2 to
ArrayConcat() --- and the spreading should occur because the value is an Array,
and regardless of whether @@isConcatSpreadable is set to undefined or not.

The API is sort of confusing so I'm not totally sure how to simulate that.

[adamk, 2015/07/09 15:56:04]

Is the idea just to check that the check is doing IsJSArray() instead of
instanceof? That seems like a separate concern from the security check test case
going on here.

[caitp (gmail), 2015/07/09 16:02:09]

Per spec, if @@isConcatSpreadable is undefined, but the value is an exotic Array
object (or a real subclass), the value is always spread --- so EG, a
cross-origin Elements object would be spread due to subclassing Array.

So I just want to also assert that, even though the @@isConcatSpreadable value
is ignored, it will still perform the spread for a cross-origin exotic Array
object

[adamk, 2015/07/09 17:17:25]

I see what you're aiming for, but Arrays are never access checked (and at the
moment I don't believe there's any way to create an Array subclass that is
access checked). That's why it seems like a separate concern, test-wise. The V8
model is sadly brittle, but what it attempts to do is disallow
non-access-checked objects from ever being shared across origins by cutting off
access at the access-checking boundary (either the Window or Location objects).

[caitp (gmail), 2015/07/09 18:43:15]

oops, https://codereview.chromium.org/1230793002/#msg9 was meant for here

+  CHECK(result2->IsArray());
+  CHECK(result2.As<Object>()->Get(0)->Equals(global_object));
+  CHECK(result2.As<Object>()->Get(1)->Equals(global_object));
+  CHECK(result2.As<Object>()->Get(2)->Equals(protected_object));
+}