DFG doesn't properly handle a property that is change to read only in a prototype

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

Consider the code:

var SimpleObject = function () {
    this.a = 0;
    this.b = 1;
    this.c = 2;
}

var proto = { p: 100 };

SimpleObject.prototype = proto;

var test = function () {
    var o = new SimpleObject();
    o.x = 10;
    o.y = 11;
    return o;
}

The results of calling test() is an object like:
    { a: 0, b: 1, c: 2, p: 100, x: 10, y: 11 }

If you then call
    Object.defineProperty(proto, "a", { value: 101, writable: false });

The results of calling test() should be an object like:
    { a: 101, b: 1, c: 2, p: 100, x: 10, y: 11 }

The DFG doesn't check for the ReadOnly case and therefore doesn't reflect the change in prototype.

[Michael Saboff]

Created attachment 312808 [details]
Patch

[Michael Saboff]

<rdar://problem/28476667>

[Michael Saboff]

Committed r218203: <http://trac.webkit.org/changeset/218203>

[Michael Saboff]

*** Bug 162567 has been marked as a duplicate of this bug. ***