Bug 66451 - Assigning a value to an existing non-enumerable property of a built-in before accessing it change its [[Enumerable]] attribute to true
: Assigning a value to an existing non-enumerable property of a built-in before...
Status: UNCONFIRMED
: WebKit
JavaScriptCore
: 528+ (Nightly build)
: Unspecified Unspecified
: P2 Normal
Assigned To:
: http://dl.dropbox.com/u/513327/enum_b...
:
:
:
  Show dependency treegraph
 
Reported: 2011-08-17 22:41 PST by
Modified: 2011-09-15 15:39 PST (History)


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2011-08-17 22:41:44 PST
From the es-discuss posts:
https://mail.mozilla.org/pipermail/es-discuss/2011-August/016290.html
https://mail.mozilla.org/pipermail/es-discuss/2011-August/016293.html
https://mail.mozilla.org/pipermail/es-discuss/2011-August/016298.html
https://mail.mozilla.org/pipermail/es-discuss/2011-August/016306.html

Oliver wrote:
> I suspect that this only applies to builtin properties on objects, as I think JSC has a similar issue.
> 
> Speaking for JSC (but i wouldn't be surprised if V8 did something similar) we will delay the creation of the majority of builtin properties until they're actually used, eg. until you actually access Array.prototype.reduce we won't reify the property.  A side effect of this is that when you simply assign to the property we skip reification, and so the property attributes are the same as you would get if you were creating a new property.
> 
> A simple test would be to see if
> Array.prototype.reduce;
> Array.prototype.reduce = ...
>
> Results in the correct behavior.

I have created a test case here:
http://dl.dropbox.com/u/513327/enum_bug.html
------- Comment #1 From 2011-08-17 23:38:06 PST -------
Related V8 issue:
http://code.google.com/p/v8/issues/detail?id=1623