Properly fix enumerate / Object.keys wrt access checked objects

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 8122 matching lines @@
   // Change env2 to a different domain and test again.
   env2->SetSecurityToken(bar);
   {
     Context::Scope scope_env2(env2);
     Local<Value> result = CompileRun(test);
     CHECK(result.IsEmpty());
   }
 }
 
 
-THREADED_TEST(CrossDomainForIn) {
+THREADED_TEST(CrossDomainFor) {
   LocalContext env1;
   v8::HandleScope handle_scope(env1->GetIsolate());
   v8::Handle<Context> env2 = Context::New(env1->GetIsolate());
 
   Local<Value> foo = v8_str("foo");
   Local<Value> bar = v8_str("bar");
 
   // Set to the same domain.
   env1->SetSecurityToken(foo);
   env2->SetSecurityToken(foo);
 
   env1->Global()->Set(v8_str("prop"), v8_num(3));
   env2->Global()->Set(v8_str("env1"), env1->Global());
 
   // Change env2 to a different domain and set env1's global object
   // as the __proto__ of an object in env2 and enumerate properties
   // in for-in. It shouldn't enumerate properties on env1's global
   // object.
   env2->SetSecurityToken(bar);
   {
     Context::Scope scope_env2(env2);
     Local<Value> result = CompileRun(
         "(function() {"
-        "  var obj = { '__proto__': env1 };"
         "  try {"
-        "    for (var p in obj) {"
+        "    for (var p in env1) {"
         "      if (p == 'prop') return false;"
         "    }"
         "    return true;"
         "  } catch (e) {"
         "    return false;"
         "  }"
         "})()");
     CHECK(result->IsTrue());
   }
 }
 
 
+THREADED_TEST(CrossDomainForInOnPrototype) {
+  LocalContext env1;
+  v8::HandleScope handle_scope(env1->GetIsolate());
+  v8::Handle<Context> env2 = Context::New(env1->GetIsolate());
+
+  Local<Value> foo = v8_str("foo");
+  Local<Value> bar = v8_str("bar");
+
+  // Set to the same domain.
+  env1->SetSecurityToken(foo);
+  env2->SetSecurityToken(foo);
+
+  env1->Global()->Set(v8_str("prop"), v8_num(3));
+  env2->Global()->Set(v8_str("env1"), env1->Global());
+
+  // Change env2 to a different domain and set env1's global object
+  // as the __proto__ of an object in env2 and enumerate properties
+  // in for-in. It shouldn't enumerate properties on env1's global
+  // object.
+  env2->SetSecurityToken(bar);
+  {
+    Context::Scope scope_env2(env2);
+    Local<Value> result = CompileRun(
+        "(function() {"
+        "  var obj = { '__proto__': env1 };"
+        "  try {"
+        "    for (var p in obj) {"
+        "      if (p == 'prop') return false;"
+        "    }"
+        "    return false;"
+        "  } catch (e) {"
+        "    return true;"
+        "  }"
+        "})()");
+    CHECK(result->IsTrue());
+  }
+}
+
+
 TEST(ContextDetachGlobal) {
   LocalContext env1;
   v8::HandleScope handle_scope(env1->GetIsolate());
   v8::Handle<Context> env2 = Context::New(env1->GetIsolate());
 
   Local<v8::Object> global1 = env1->Global();
 
   Local<Value> foo = v8_str("foo");
 
   // Set to the same domain.
@@ skipping 428 matching lines @@
       "(function() {"
       "  var obj = { '__proto__': other };"
       "  try {"
       "    for (var p in obj) {"
       "      if (p == 'accessible_prop' ||"
       "          p == 'blocked_js_prop' ||"
       "          p == 'blocked_js_prop') {"
       "        return false;"
       "      }"
       "    }"
+      "    return false;"
+      "  } catch (e) {"
       "    return true;"
-      "  } catch (e) {"
-      "    return false;"
       "  }"
       "})()");
   CHECK(value->IsTrue());
 
   context1->Exit();
   context0->Exit();
 }
 
 
 TEST(AccessControlES5) {
@@ skipping 23 matching lines @@
   context0->Enter();
 
   v8::Handle<v8::Object> global0 = context0->Global();
 
   v8::Local<Context> context1 = Context::New(isolate);
   context1->Enter();
   v8::Handle<v8::Object> global1 = context1->Global();
   global1->Set(v8_str("other"), global0);
 
   // Regression test for issue 1154.
-  CHECK(CompileRun("Object.keys(other)").IsEmpty());
+  CHECK(CompileRun("Object.keys(other).length == 0")->BooleanValue());
   CHECK(CompileRun("other.blocked_prop").IsEmpty());
 
   // Regression test for issue 1027.
   CompileRun("Object.defineProperty(\n"
              "  other, 'blocked_prop', {configurable: false})");
   CHECK(CompileRun("other.blocked_prop").IsEmpty());
   CHECK(CompileRun("Object.getOwnPropertyDescriptor(other, 'blocked_prop')")
             .IsEmpty());
 
   // Regression test for issue 1171.
@@ skipping 13149 matching lines @@
       "    fake.age;\n"
       "    result = 1;\n"
       "  } catch (e) {\n"
       "  }\n"
       "  test(d+1);\n"
       "}\n"
       "test(0);\n"
       "result;\n",
       0);
 }