__proto__ is used

[iegik]

Description

Object.prototype.__proto__

Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

— https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto

Example

if (a.shadyUpgradeFragment && !w.Pa) {
    var b = a.shadyUpgradeFragment;
    b.__proto__ = ShadowRoot.prototype;
    b.ya(this, a); // <--- if we do not allow to change the b.__proto__ - it still be a null
    wc(b, b);
    a = b.__noInsertionPoint ? null : b.querySelectorAll("slot");
    b.__noInsertionPoint = void 0;
    a && a.length && (b.sa(a),
    b.s());
    b.host.__shady_native_appendChild(b)
} else

Steps to reproduce

Run following code to protect changing the __proto__ value:

  Object.getOwnPropertyNames(Object.prototype).forEach((key) => {
    const orig = Object.prototype[key];
    // if (key === '__proto__') return;
    if (!Object.getOwnPropertyDescriptor(Object.prototype, key)?.configurable)
      return;

    Object.defineProperty(Object.prototype, key, {
      configurable: false,
      set: () => {
        /*readonly*/
      },
      get: () => orig,
    });
    console.log('freezed', key, orig);
  });

Expected behavior

No error is thrown

Actual behavior

Error is thrown:

webcomponents-sd.js:95 Uncaught TypeError: b.ya is not a function
    at HTMLElement.attachShadow [as __shady_attachShadow] (webcomponents-sd.js:95:222)
    at P.attachShadow (webcomponents-sd.js:123:124)
    at a._attachDom (desktop_polymer.js:4254:96)
    at a._readyClients (desktop_polymer.js:4253:70)
    at a._flushClients (desktop_polymer.js:4176:125)
    at a._propertiesChanged (desktop_polymer.js:4182:69)
    at HTMLElement._flushProperties (desktop_polymer.js:4053:200)
    at a.ready (desktop_polymer.js:4180:35)
    at a.ready (desktop_polymer.js:4252:131)
    at a.ready (desktop_polymer.js:4563:48)

Version

Browsers affected

• [x] Chrome
• [ ] Firefox
• [ ] Edge
• [ ] Safari
• [ ] IE 11

[iegik]

https://github.com/webcomponents/polyfills/pull/573