| Summary: | Date.prototype.toLocaleDateString uses overridable Object.create | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Joseph Pecoraro <joepeck> | ||||||
| Component: | JavaScriptCore | Assignee: | Joseph Pecoraro <joepeck> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | andy, benjamin, commit-queue, keith_miller, mark.lam, msaboff, saam, ysuzuki | ||||||
| Priority: | P2 | ||||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Attachments: |
|
||||||||
Created attachment 274973 [details]
[PATCH] Proposed Fix
Comment on attachment 274973 [details]
[PATCH] Proposed Fix
r=me
Comment on attachment 274973 [details] [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=274973&action=review > LayoutTests/js/script-tests/regress-155917.js:2 > +"Regression test for https://webkit.org/b/140579. This test should run without throwing an exception." Typo! This should be 155917 Created attachment 274974 [details]
[PATCH] For Landing
Comment on attachment 274974 [details] [PATCH] For Landing Clearing flags on attachment: 274974 Committed r198711: <http://trac.webkit.org/changeset/198711> All reviewed patches have been landed. Closing bug. |
* SUMMARY Date.prototype.toLocaleDateString uses overridable Object.create. * TEST <script> Object.create = function() { console.log("HERE"); } (new Date).toLocaleString() </script> * RESULTS "HERE" is logged and a TypeError is thrown. * NOTES The builtin implementation has: options = @Object.create(options) Seems this should be: options = @Object.@create(options); Otherwise it could be using a user overridden version of Object.create. Perhaps here we can just use a regular object literal here.