695579 - E4X prototype not freezable

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Mark S. Miller]

> Object.freeze(Object.getPrototypeOf(<foo/>))
TypeError on line 1: can't change object's extensibility

For all other literals -- Object, Array, RegExp, Function -- their prototype is freezable on all browsers. This is important since, without parsing, there's no way to deny untrusted code the ability to instantiate these literals, and thereby to obtain access to the object they inherit from. (Since they are starting from literals, SES's scope games do not help.) 

By contrast to any of these, on FF currently, two pieces of untrusted code in the same frame that should be isolated from each other can use E4X literals to obtain undeniable shared access to the XML.prototype, and thereby to communicate and to leak capabilities.

Comment 1

[Mark S. Miller]

Note that, if https://bugzilla.mozilla.org/show_bug.cgi?id=695577 is fixed, then this bug no longer matters.

Comment 2

[Nicholas Nethercote [inactive]]

> Note that, if https://bugzilla.mozilla.org/show_bug.cgi?id=695577 is fixed,
> then this bug no longer matters.

Done.