<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>72766</bug_id>
          
          <creation_ts>2011-11-18 15:18:47 -0800</creation_ts>
          <short_desc>Setting a property on an object whose prototype has a readonly property of the same name should not work</short_desc>
          <delta_ts>2012-03-01 02:20:24 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>DUPLICATE</resolution>
          <dup_id>79069</dup_id>
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Boris Zbarsky">bzbarsky</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>barraclough</cc>
    
    <cc>jwalden+bwo</cc>
    
    <cc>oliver</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>506115</commentid>
    <comment_count>0</comment_count>
      <attachid>115885</attachid>
    <who name="Boris Zbarsky">bzbarsky</who>
    <bug_when>2011-11-18 15:18:47 -0800</bug_when>
    <thetext>Created attachment 115885
Testcase

The attached testcase should print &quot;PASS&quot; twice.  Instead, it prints &quot;FAIL&quot; twice in JavaScriptCore.

The relevant analysis per ECMA-262 follows:

1) Per section 15.2.3.9, Object.freeze reconfigures data properties not
   be writable.
2) Per section 11.13.1, setting &quot;test_instance.x = &apos;hello&apos;&quot; calls
   PutValue() with &quot;test_instance.x&quot; as the first argument.
3) Per section 8.7.2 step 4 the [[Put]] internal method of
   test_instance is called.  IsStrictReference is true if an only if
   the code is in strict mode.
4) Per section 8.12.5 step 1, the [[CanPut]] internal method of
   test_instance is called.
5) Per section 8.12.4 step 1, [[GetOwnProperty]] is called on
   test_instance; in this case it returns undefined, so step 2 is
   skipped.
6) Per section 8.12.4 step 5 [[GetProperty]] is called on the prototype
   and returns a data descriptor for a non-writable data property.
7) Per section 8.12.4 step 8b, [[CanPut]] returns false.
8) Per section 8.12.5 step 1, either a TypeError is thrown or the set
   is ignored, depending on whether the code is in strict mode.

JavaScriptCore most certainly doesn&apos;t do the above.

SpiderMonkey gets this right.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>506439</commentid>
    <comment_count>1</comment_count>
    <who name="Boris Zbarsky">bzbarsky</who>
    <bug_when>2011-11-19 13:58:29 -0800</bug_when>
    <thetext>Step 2 should be:

2) Per section 11.13.1, setting &quot;test_instance.x&quot; calls
   PutValue() with &quot;test_instance.x&quot; as the first argument.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>568487</commentid>
    <comment_count>2</comment_count>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2012-03-01 02:20:24 -0800</bug_when>
    <thetext>This has been fixed in r108304.

*** This bug has been marked as a duplicate of bug 79069 ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>115885</attachid>
            <date>2011-11-18 15:18:47 -0800</date>
            <delta_ts>2011-11-18 15:18:47 -0800</delta_ts>
            <desc>Testcase</desc>
            <filename>test.js</filename>
            <type>text/plain</type>
            <size>503</size>
            <attacher name="Boris Zbarsky">bzbarsky</attacher>
            
              <data encoding="base64">KGZ1bmN0aW9uICgpIHsKICAgIHZhciB0ZXN0ID0gZnVuY3Rpb24oKSB7IHJldHVybiB0aGlzOyB9
OwogICAgdGVzdC5wcm90b3R5cGUgPSB7IHg6ICdQQVNTJyB9OwogICAgT2JqZWN0LmZyZWV6ZSh0
ZXN0LnByb3RvdHlwZSk7CiAgICB2YXIgdGVzdF9pbnN0YW5jZSA9IG5ldyB0ZXN0OwogICAgdGVz
dF9pbnN0YW5jZS54ICAgPSAnRkFJTCc7CiAgICBwcmludCh0ZXN0X2luc3RhbmNlLngpOwp9KSgp
OwoKKGZ1bmN0aW9uICgpIHsKICAgICJ1c2Ugc3RyaWN0IjsKICAgIHZhciB0ZXN0ID0gZnVuY3Rp
b24oKSB7IHJldHVybiB0aGlzOyB9OwogICAgdGVzdC5wcm90b3R5cGUgPSB7IHg6IDEgfTsKICAg
IE9iamVjdC5mcmVlemUodGVzdC5wcm90b3R5cGUpOwogICAgdmFyIHRlc3RfaW5zdGFuY2UgPSBu
ZXcgdGVzdDsKICAgIHRyeSB7Cgl0ZXN0X2luc3RhbmNlLnggICA9IDI7CglwcmludCgiRkFJTCIp
OwogICAgfSBjYXRjaCAoZSkgewoJcHJpbnQoIlBBU1MiKTsKICAgIH0KfSkoKTs=
</data>

          </attachment>
      

    </bug>

</bugzilla>