B.3.1 The __proto__ pseudo property

André Bargull andre.bargull at udo.edu
Sun Apr 21 13:19:08 PDT 2013

> SpiderMonkey at least goes out of its way to do [[Set]] (let's call it)
> not [[DefineOwnProperty]] for 'o = {__proto__: 42}', so why wouldn't
> [[Set]] create a fresh property, seeing nothing on Object.prototype
> named '__proto__' with a setter to run?

SpiderMonkey/JSC currently just use [[Set]] without any further checks, 
i.e. when you re-define Object.prototype.__proto__, you're able to 
interfere object creation which uses __proto__. Is this intentional?

js> Object.defineProperty(Object.prototype, "__proto__", {set: 
js> ({__proto__: null})

- André

More information about the es-discuss mailing list