Add access check for observed objects

src/object-observe.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 257 matching lines @@
   return ObjectUnobserve(object, callback);
 }
 
 function EnqueueToCallback(callback, changeRecord) {
   var callbackInfo = NormalizeCallbackInfo(callback);
   observationState.pendingObservers[callbackInfo.priority] = callback;
   callbackInfo.push(changeRecord);
   %SetObserverDeliveryPending();
 }
 
-function EnqueueChangeRecord(changeRecord, observers) {
+function EnqueueChangeRecord(changeRecord, observers, skipAccessCheck) {
   // TODO(rossberg): adjust once there is a story for symbols vs proxies.
   if (IS_SYMBOL(changeRecord.name)) return;
 
+  var object = changeRecord.object;
+  var needsAccessCheck = !skipAccessCheck && %IsAccessCheckNeeded(object);
   for (var i = 0; i < observers.length; i++) {
     var observer = observers[i];
     if (IS_UNDEFINED(observer.accept[changeRecord.type]))
       continue;
 
+    if (needsAccessCheck &&
+        // Drop all splice records on the floor for access-checked objects
+        (changeRecord.type == 'splice' ||
+         !%GetAccessAllowedForObserver(
+             observer.callback, object, changeRecord.name))) {
+      continue;
+    }
+
     EnqueueToCallback(observer.callback, changeRecord);
   }
 }
 
 function BeginPerformSplice(array) {
   var objectInfo = objectInfoMap.get(array);
   if (!IS_UNDEFINED(objectInfo))
     BeginPerformChange(objectInfo, 'splice');
 }
 
@@ skipping 50 matching lines @@
     return;
 
   var newRecord = { object: target };
   for (var prop in changeRecord) {
     if (prop === 'object') continue;
     %DefineOrRedefineDataProperty(newRecord, prop, changeRecord[prop],
         READ_ONLY + DONT_DELETE);
   }
   ObjectFreeze(newRecord);
 
-  EnqueueChangeRecord(newRecord, objectInfo.changeObservers);
+  EnqueueChangeRecord(newRecord, objectInfo.changeObservers,
+      true /* skip access check */);
 }
 
 function ObjectNotifierPerformChange(changeType, changeFn, receiver) {
   if (!IS_SPEC_OBJECT(this))
     throw MakeTypeError("called_on_non_object", ["performChange"]);
 
   var target = notifierTargetMap.get(this);
   if (IS_UNDEFINED(target))
     throw MakeTypeError("observe_notify_non_notifier");
   if (!IS_STRING(changeType))
@@ skipping 88 matching lines @@
     "observe", ArrayObserve,
     "unobserve", ArrayUnobserve
   ));
   InstallFunctions(notifierPrototype, DONT_ENUM, $Array(
     "notify", ObjectNotifierNotify,
     "performChange", ObjectNotifierPerformChange
   ));
 }
 
 SetupObjectObserve();