Bug 55171 – Omitted value field in descriptor passed to Object.defineProperty is mishandled

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: JavaScriptCore

[Jeff Walden (remove +bwo to email)]

jsc behavior:

> typeof Object.defineProperty(Object.defineProperty({}, "p", { value: 7, writable: false, configurable: false, enumerable: true }), "p", { writable: false })
Exception: TypeError: Attempting to change value of a readonly property.

Correct behavior:

js> typeof Object.defineProperty(Object.defineProperty({}, "p", { value: 7, writable: false, configurable: false, enumerable: true }), "p", { writable: false })
"object"

[Oliver Hunt]

(In reply to comment #0)
> jsc behavior:
> 
> > typeof Object.defineProperty(Object.defineProperty({}, "p", { value: 7, writable: false, configurable: false, enumerable: true }), "p", { writable: false })
> Exception: TypeError: Attempting to change value of a readonly property.
> 
> Correct behavior:
> 
> js> typeof Object.defineProperty(Object.defineProperty({}, "p", { value: 7, writable: false, configurable: false, enumerable: true }), "p", { writable: false })
> "object"

Erk is that ToT or shipping safari?

I have a dream that it's shipping safari, but i suspect not :-(

[Jeff Walden (remove +bwo to email)]

It's a fairly recent svn checkout, r77758 if the build correlates to the revision of my tree (they should be, I update+build through a single shell alias).  I don't know if a shipping Safari has this.

I did an update and rebuild, and it's still present with r79663 (unsurprising as I happened to notice the problem by inspection of the algorithm).

[Gavin Barraclough]

This works in ToT.  I've fixed a lot of defineOwnProperty bugs in the last couple of months, I'm not going to work out exactly which revision landed the fix for this particular failure. :-)