49577 2010-11-15 21:51:25 -0800 Function.prototype should be non-configurable 2010-11-18 20:39:51 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 1 barraclough webkit-unassigned ricow oldest_to_newest 309580 0 barraclough 2010-11-15 21:51:25 -0800 JSC lazily allocates the prototype property of Function objects. We check the prototype exists on 'get', but not on 'put'. If you 'put' without having first done a 'get' you can end up with a configurable prototype (prototype should only ever be non-configurable). This is visible in a couple of ways: * 'delete' on the property may succeed. (the next access will result in a new, reset prototype object). * the prototype may be set to a getter. 309604 1 barraclough 2010-11-15 23:28:11 -0800 fixed in http://trac.webkit.org/changeset/72063 310139 2 ricow 2010-11-16 23:22:12 -0800 It seems that the change introduces a test that is not consistent with the specification. The new test file: LayoutTests/fast/js/script-tests/function-prototype-descriptor.js Tests that the prototype property on a function is enumerable, which it should not be (see 15.3.5.2 and 13.2 step 18 in the spec). This was also discussed on the V8 issue tracker: http://code.google.com/p/v8/issues/detail?id=935 Please let me know if you disagree. 311176 3 barraclough 2010-11-18 16:54:18 -0800 Hi Rico, Yes, looks to me like you're right. Should be a quick fix, will roll a patch for JSC & update regression tests. thanks, G. 311268 4 barraclough 2010-11-18 20:39:51 -0800 Many thanks for bringing this to our attention Rico, should be fixed in r72362. Let me know if this doesn't resolve the issues for you. cheers, G.