78438 2012-02-12 14:18:05 -0800 Failed strict assignment to __proto__ not throwing 2012-02-20 13:54:45 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 78409 P2 Normal --- 0 erights webkit-unassigned barraclough erights oliver oldest_to_newest 554855 0 erights 2012-02-12 14:18:05 -0800 In Version 5.1.2 (7534.52.7, r107511): > var x = Object.preventExtensions({}); > var y = {}; > function foo(){"use strict"; x.__proto__ = y;} > Object.getPrototypeOf(x) === Object.prototype true > foo() > Object.getPrototypeOf(x) === Object.prototype true The above behavior correctly does not mutate x.__proto__, however, since it is a failed assignment and foo() is strict, the call to foo() should have thrown an exception. Instead it failed silently. 554856 1 erights 2012-02-12 14:20:02 -0800 See https://bugs.webkit.org/show_bug.cgi?id=65832 554859 2 erights 2012-02-12 14:24:31 -0800 On Version 5.1.2 (7534.52.7) I get > foo() TypeError: Attempted to assign to readonly property. which is correct, so this is a regression. 554944 3 barraclough 2012-02-12 19:02:59 -0800 Ah agreed, we should be following step 3 of your proposal here ( http://wiki.ecmascript.org/doku.php?id=strawman:magic_proto_property ), this will still be a change from our previous behavior, but will be more restrictive rather than less. Thanks for the bug Mark! 560344 4 barraclough 2012-02-20 13:54:45 -0800 I had to roll out bug#78409 to fix a couple of test cases, when I re-landed it I fixed this too. There is a test case covering this. All should hopefully be good now, cheers for the bug report. *** This bug has been marked as a duplicate of bug 78409 ***