Lecture series on SES and capability-based security by Mark Miller

[Allen Wirfs-Brock]

You can't "over-ride" an inherited read-only property by assignment. See ES5.1 8.12.4

You could do it via Object.defineProperty, but that requires direct access to the object.

Allen

On Nov 4, 2011, at 11:01 AM, Axel Rauschmayer wrote:

> But hackedPush is added to the instance, not Array.prototype.
> 
> On Nov 4, 2011, at 18:59 , Allen Wirfs-Brock wrote:
> 
>> 
>> On Nov 4, 2011, at 10:33 AM, Axel Rauschmayer wrote:
>> 
>>> How about:
>>> 
>>>   function Bob(t) {
>>>      var stolenArray;
>>>      var hackedPush = function() {
>>>          stolenArray = this;
>>>      };
>>>      t.store("push", hackedPush);
>> 
>> 
>> If Array.prototype has been frozen (as the problem statement implied) then the above line should throw.
>> 
>> 
>> Allen
> 
> -- 
> Dr. Axel Rauschmayer
> axel at rauschma.de
> 
> home: rauschma.de
> twitter: twitter.com/rauschma
> blog: 2ality.com
> 
> 
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20111104/efb84b04/attachment-0001.html>