Bug 36738 – JS assignment to an existing property should not change the attributes of the property

• Component: JavaScriptCore
• Status: RESOLVED CONFIGURATION CHANGED

[Xianzhu Wang]

What steps will reproduce the problem?
1. Open the attached HTML file

What is the expected result?
Should alert 'false'.

What happens instead?
Alerts 'true'.

According to ECMA262v3 8.6.2.2 [[Put]] (P, V)
4. Set the value of the property to V. The attributes of the property are 
not changed
so Array.property.push should still have DontEnum attribute after assigned 
another value.

ECMA262v5 8.12.5 3. also implies that the attributes of an existing 
property should be preserved when the property is assigned another value.

This issue causes some compatibility issues. Some web page using for...in 
to enumerate properties of arrays or objects after some default methods are overridden.

[Oliver Hunt]

No file is attached -- i assume your test is:
Array.prototype.push = ...
for (i in [])
   if (i=="push") return true;

Or some such.

If so try doing:
Array.prototype.push; // Read it first
Array.prototype.push = ...
...

If the test passes in the second case i have a fairly good idea of what's going on.

[Xianzhu Wang]

Created attachment 52117 [details]
Test case

[Xianzhu Wang]

(In reply to comment #1)
> No file is attached -- i assume your test is:

Sorry I forgot to attach the test file. Your assumption is exactly right. :)

> If so try doing:
> Array.prototype.push; // Read it first
> Array.prototype.push = ...
> ...
> 
> If the test passes in the second case i have a fairly good idea of what's going
> on.

Yes, reading it first can pass the test.

[Alexey Proskuryakov]

Still an issue with r74765.

[Ahmad Saleem]

Based on attached test case (assuming it is correct), Safari 15.6 on macOS 12.5 shows expected result and 'false' alert is shown. It matches with other browsers (Chrome Canary 105 and Firefox Nightly 104).

I think this was fixed along the way and can be marked as "RESOLVED CONFIGURATION CHANGED". Thanks!