Don't fail to call OBJ_CHECK_ACCESS for o.__proto__ = x, with enough mode bits to say what's happening (143369, r=shaver, sr=jst).

js/src/jsobj.c

@@ -170,7 +170,7 @@ static JSBool
 obj_setSlot(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
 {
     JSObject *pobj;
-    uint32 slot;
+    uint32 slot, attrs;
 
     if (!JSVAL_IS_OBJECT(*vp))
         return JS_TRUE;
@@ -178,6 +178,11 @@ obj_setSlot(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     slot = (uint32) JSVAL_TO_INT(id);
     if (JS_HAS_STRICT_OPTION(cx) && !ReportStrictSlot(cx, slot))
         return JS_FALSE;
+
+    /* __parent__ is readonly and permanent, only __proto__ may be set. */
+    if (!OBJ_CHECK_ACCESS(cx, obj, id, JSACC_PROTO | JSACC_WRITE, vp, &attrs))
+        return JS_FALSE;
+
     return js_SetProtoOrParent(cx, obj, slot, pobj);
 }
 

js/src/jspubtd.h

@@ -78,15 +78,17 @@ typedef enum JSType {
 
 /* JSObjectOps.checkAccess mode enumeration. */
 typedef enum JSAccessMode {
-    JSACC_PROTO,                /* XXXbe redundant w.r.t. id */
-    JSACC_PARENT,               /* XXXbe redundant w.r.t. id */
-    JSACC_IMPORT,               /* import foo.bar */
-    JSACC_WATCH,                /* a watchpoint on object foo for id 'bar' */
-    JSACC_READ,                 /* a "get" of foo.bar */
-    JSACC_WRITE,                /* a "set" of foo.bar = baz */
+    JSACC_PROTO  = 0,           /* XXXbe redundant w.r.t. id */
+    JSACC_PARENT = 1,           /* XXXbe redundant w.r.t. id */
+    JSACC_IMPORT = 2,           /* import foo.bar */
+    JSACC_WATCH  = 3,           /* a watchpoint on object foo for id 'bar' */
+    JSACC_READ   = 4,           /* a "get" of foo.bar */
+    JSACC_WRITE  = 8,           /* a "set" of foo.bar = baz */
     JSACC_LIMIT
 } JSAccessMode;
 
+#define JSACC_TYPEMASK          (JSACC_WRITE - 1)
+
 /*
  * This enum type is used to control the behavior of a JSObject property
  * iterator function that has type JSNewEnumerate.