Implement loads and calls from 'super'

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/lookup.h"
 #include "src/lookup-inl.h"
@@ skipping 252 matching lines @@
                          PrototypeIterator::START_AT_RECEIVER);
   do {
     if (JSReceiver::cast(iter.GetCurrent()) == holder) return true;
     DCHECK(!current->IsJSProxy());
     iter.Advance();
   } while (!iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN));
   return false;
 }
 
 
+void LookupIterator::LookupForRead() {
+  for (; IsFound(); Next()) {
+    switch (state()) {
+      case LookupIterator::NOT_FOUND:
+      case LookupIterator::TRANSITION:
+        UNREACHABLE();
+      case LookupIterator::JSPROXY:
+        return;
+      case LookupIterator::INTERCEPTOR: {
+        // If there is a getter, return; otherwise loop to perform the lookup.
+        Handle<JSObject> holder = GetHolder<JSObject>();
+        if (!holder->GetNamedInterceptor()->getter()->IsUndefined()) {
+          return;
+        }
+        break;
+      }
+      case LookupIterator::ACCESS_CHECK:
+        // PropertyHandlerCompiler::CheckPrototypes() knows how to emit
+        // access checks for global proxies.
+        if (GetHolder<JSObject>()->IsJSGlobalProxy() &&

[Toon Verwaest, 2014/09/15 11:57:20]

Wth? Why do you explicitly avoid access checks on everything that's not a
JSGlobalProxy? Sounds like a security issue right there. E.g.:

o = {f:function() { return super.hasOwnProperty.constructor; }};
o.f[home_object] = otherwindow.location;
otherwindow_Function = o.f();

[Dmitry Lomov (no reviews), 2014/09/15 12:31:12]

As discussed offline, this returns otherwise, so doesn't really avoid access
checks (it is also just a copy from ic.cc), but it looks like I do not need this
anyway

+            HasAccess(v8::ACCESS_GET)) {
+          break;
+        }
+        return;
+      case LookupIterator::PROPERTY:
+        if (HasProperty()) return;  // Yay!
+        break;
+    }
+  }
+}
+
+
 Handle<Object> LookupIterator::FetchValue() const {
   Object* result = NULL;
   Handle<JSObject> holder = GetHolder<JSObject>();
   switch (property_encoding_) {
     case DICTIONARY:
       result = holder->property_dictionary()->ValueAt(number_);
       if (holder->IsGlobalObject()) {
         result = PropertyCell::cast(result)->value();
       }
       break;
@@ skipping 81 matching lines @@
     DCHECK_EQ(v8::internal::CONSTANT, property_details_.type());
   }
 }
 
 
 void LookupIterator::InternalizeName() {
   if (name_->IsUniqueName()) return;
   name_ = factory()->InternalizeString(Handle<String>::cast(name_));
 }
 } }  // namespace v8::internal