7602.4.6

apple-opensource · apple-opensource · commit bbaf2fd7075b · 2017-01-24T21:03:22.000Z
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,18 @@
+2016-12-01  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r209149. rdar://problem/29404230
+
+    2016-11-30  Mark Lam  <mark.lam@apple.com>
+
+            Proxy is not allowed in the global prototype chain.
+            https://bugs.webkit.org/show_bug.cgi?id=165205
+
+            Reviewed by Geoffrey Garen.
+
+            * runtime/ProgramExecutable.cpp:
+            (JSC::ProgramExecutable::initializeGlobalProperties):
+            - We'll now throw a TypeError if we detect a Proxy in the global prototype chain.
+
 2016-11-11  Matthew Hanson  <matthew_hanson@apple.com>
 
         Merge r208619. rdar://problem/29225966
diff --git a/Configurations/Version.xcconfig b/Configurations/Version.xcconfig
@@ -22,8 +22,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 602;
-MINOR_VERSION = 3;
-TINY_VERSION = 12;
+MINOR_VERSION = 4;
+TINY_VERSION = 6;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);
diff --git a/runtime/Executable.cpp b/runtime/Executable.cpp
@@ -584,6 +584,15 @@ JSObject* ProgramExecutable::initializeGlobalProperties(VM& vm, CallFrame* callF
     RELEASE_ASSERT(globalObject);
     ASSERT(&globalObject->vm() == &vm);
 
+    JSValue nextPrototype = globalObject->getPrototypeDirect();
+    while (nextPrototype && nextPrototype.isObject()) {
+        if (UNLIKELY(asObject(nextPrototype)->type() == ProxyObjectType)) {
+            ExecState* exec = globalObject->globalExec();
+            return createTypeError(exec, ASCIILiteral("Proxy is not allowed in the global prototype chain."));
+        }
+        nextPrototype = asObject(nextPrototype)->getPrototypeDirect();
+    }
+
     JSObject* exception = 0;
     UnlinkedProgramCodeBlock* unlinkedCodeBlock = globalObject->createProgramCodeBlock(callFrame, this, &exception);
     if (exception)
@@ -675,7 +684,7 @@ JSObject* ProgramExecutable::initializeGlobalProperties(VM& vm, CallFrame* callF
             RELEASE_ASSERT(offsetForAssert == offset);
         }
     }
-    return 0;
+    return nullptr;
 }
 
 void ProgramExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
