According to https://tc39.github.io/ecma262/#sec-ecmascript-language-functions-and-classes, "Unless otherwise specified, the name property of a built-in Function object, if it exists, has the attributes { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }."
<rdar://problem/24799540>
Created attachment 272233 [details] work in progress: changed 'name' and 'length' properties to be reified on access.
https://tc39.github.io/ecma262/#sec-ecmascript-language-functions-and-classe also says "the length property of a built-in Function object has the attributes { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }."
Created attachment 272353 [details] proposed patch.
Created attachment 272354 [details] proposed patch: rebased.
Comment on attachment 272354 [details] proposed patch: rebased. View in context: https://bugs.webkit.org/attachment.cgi?id=272354&action=review r=me with comment > Source/JavaScriptCore/runtime/JSFunction.cpp:522 > + if (propertyName == exec->propertyNames().length) > + thisObject->reifyLengthIfNeeded(exec); > + else if (propertyName == exec->propertyNames().name) > + thisObject->reifyNameIfNeeded(exec); This code is repeated a lot. It might be worth having an inlined helper here that reifies if necessary. You could call it reifyIfNecessary(PropertyName) or something.
It might be worth adding some tests that will gracefully handle structure transitions after reification.
It's also worth adding tests that do indeed verify that the property is configurable.
Created attachment 272371 [details] proposed patch 2: addressed Saam's feedback w/ new test.
Thanks for the review. Landed in r197205: <http://trac.webkit.org/r197205>.