* SUMMARY Date.prototype.toLocaleDateString uses overridable Object.create. * TEST <script> Object.create = function() { console.log("HERE"); } (new Date).toLocaleString() </script> * RESULTS "HERE" is logged and a TypeError is thrown. * NOTES The builtin implementation has: options = @Object.create(options) Seems this should be: options = @Object.@create(options); Otherwise it could be using a user overridden version of Object.create. Perhaps here we can just use a regular object literal here.
Created attachment 274973 [details] [PATCH] Proposed Fix
Comment on attachment 274973 [details] [PATCH] Proposed Fix r=me
Comment on attachment 274973 [details] [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=274973&action=review > LayoutTests/js/script-tests/regress-155917.js:2 > +"Regression test for https://webkit.org/b/140579. This test should run without throwing an exception." Typo! This should be 155917
Created attachment 274974 [details] [PATCH] For Landing
Comment on attachment 274974 [details] [PATCH] For Landing Clearing flags on attachment: 274974 Committed r198711: <http://trac.webkit.org/changeset/198711>
All reviewed patches have been landed. Closing bug.