Bug 75935

Summary: Do not allow Array length to be set if it is non-configurable
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fix sam: review+

Gavin Barraclough
Reported 2012-01-09 21:15:49 PST
Do not allow Array length to be set if it is non-configurable, and if the new length is less than the old length then intervening properties should removed in reverse order. Removal of properties should cease if an intervening indexed property being removed is non-configurable.
Attachments
Fix (18.32 KB, patch)
2012-01-09 22:11 PST, Gavin Barraclough 		sam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2012-01-09 22:11:32 PST
Created attachment 121793 [details] Fix No performance impact.
Gavin Barraclough
Comment 2 2012-01-10 11:28:01 PST
Fixed in r104604
Gavin Barraclough
Comment 3 2012-01-10 13:02:23 PST
32-bit build fix in r104620
Note You need to log in before you can comment on or make changes to this bug.