[d8 Workers] Make Worker prototype read-only

BUG=chromium:518747
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1277543006

Cr-Commit-Position: refs/heads/master@{#30099}

diff --git a/src/d8.cc b/src/d8.cc
index d55faabe8bcc414624f485a9af2c432516185dd6..5fa7c262994c77076951bf97022d00e2c0119731 100644 (file)
--- a/src/d8.cc
+++ b/src/d8.cc
@@ -1144,6 +1144,7 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
   worker_fun_template->SetClassName(
       String::NewFromUtf8(isolate, "Worker", NewStringType::kNormal)
           .ToLocalChecked());
+  worker_fun_template->ReadOnlyPrototype();
   worker_fun_template->PrototypeTemplate()->Set(
       String::NewFromUtf8(isolate, "terminate", NewStringType::kNormal)
           .ToLocalChecked(),

diff --git a/test/mjsunit/regress/regress-crbug-518747.js b/test/mjsunit/regress/regress-crbug-518747.js
new file mode 100644 (file)
index 0000000..f1787c4
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-518747.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+  Worker.prototype = 12;
+  var __v_6 = new Worker('');
+  __v_6.postMessage([]);
+}