GeezerVison

Member descriptors are plain object literals that spell out only the
members they need, so createDictionaryConverter() reading the optional
validator, defaultValue and required members off them resolves through
%Object.prototype%.

Copy each descriptor once at construction time with every key present.
They keep an ordinary prototype because a null-prototype object literal
lands in V8 dictionary mode, and dictionaries with no defaults and no
required members now skip steps 4.1.5 and 4.1.6.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

BufferSource conversion hands over the caller's own object uncopied, so
byteLength, byteOffset, buffer and length reads on it run
user-replaceable prototype accessors. Internal lookup tables are indexed
with computed keys, so a polluted %Object.prototype% key answers a miss.
The %Set% constructor iterates its argument through the user-mutable
%Array.prototype% iterator.

The algorithm registry and the hash name tables are detached from
%Object.prototype% after construction rather than declared
`__proto__: null`, which V8 places in dictionary mode.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Member descriptors are plain object literals that spell out only the
members they need, so createDictionaryConverter() reading the optional
validator, defaultValue and required members off them resolves through
%Object.prototype%.

Copy each descriptor once at construction time with every key present.
They keep an ordinary prototype because a null-prototype object literal
lands in V8 dictionary mode, and dictionaries with no defaults and no
required members now skip steps 4.1.5 and 4.1.6.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

BufferSource conversion hands over the caller's own object uncopied, so
byteLength, byteOffset, buffer and length reads on it run
user-replaceable prototype accessors. Internal lookup tables are indexed
with computed keys, so a polluted %Object.prototype% key answers a miss.
The %Set% constructor iterates its argument through the user-mutable
%Array.prototype% iterator.

The algorithm registry and the hash name tables are detached from
%Object.prototype% after construction rather than declared
`__proto__: null`, which V8 places in dictionary mode.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Member descriptors are plain object literals that spell out only the
members they need, so createDictionaryConverter() reading the optional
validator, defaultValue and required members off them resolves through
%Object.prototype%.

Copy each descriptor once at construction time with every key present.
They keep an ordinary prototype because a null-prototype object literal
lands in V8 dictionary mode, and dictionaries with no defaults and no
required members now skip steps 4.1.5 and 4.1.6.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

BufferSource conversion hands over the caller's own object uncopied, so
byteLength, byteOffset, buffer and length reads on it run
user-replaceable prototype accessors. Internal lookup tables are indexed
with computed keys, so a polluted %Object.prototype% key answers a miss.
The %Set% constructor iterates its argument through the user-mutable
%Array.prototype% iterator.

The algorithm registry and the hash name tables are detached from
%Object.prototype% after construction rather than declared
`__proto__: null`, which V8 places in dictionary mode.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Member descriptors are plain object literals that spell out only the
members they need, so createDictionaryConverter() reading the optional
validator, defaultValue and required members off them resolves through
%Object.prototype%.

Copy each descriptor once at construction time with every key present.
They keep an ordinary prototype because a null-prototype object literal
lands in V8 dictionary mode, and dictionaries with no defaults and no
required members now skip steps 4.1.5 and 4.1.6.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

BufferSource conversion hands over the caller's own object uncopied, so
byteLength, byteOffset, buffer and length reads on it run
user-replaceable prototype accessors. Internal lookup tables are indexed
with computed keys, so a polluted %Object.prototype% key answers a miss.
The %Set% constructor iterates its argument through the user-mutable
%Array.prototype% iterator.

The algorithm registry and the hash name tables are detached from
%Object.prototype% after construction rather than declared
`__proto__: null`, which V8 places in dictionary mode.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>