Bug 66451 - Assigning a value to an existing non-enumerable property of a built-in before accessing it change its [[Enumerable]] attribute to true
Summary: Assigning a value to an existing non-enumerable property of a built-in before...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL: http://dl.dropbox.com/u/513327/enum_b...
Depends on:
Reported: 2011-08-17 22:41 PDT by John-David Dalton
Modified: 2019-06-09 19:20 PDT (History)
4 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description John-David Dalton 2011-08-17 22:41:44 PDT
From the es-discuss posts:

Oliver wrote:
> I suspect that this only applies to builtin properties on objects, as I think JSC has a similar issue.
> Speaking for JSC (but i wouldn't be surprised if V8 did something similar) we will delay the creation of the majority of builtin properties until they're actually used, eg. until you actually access Array.prototype.reduce we won't reify the property.  A side effect of this is that when you simply assign to the property we skip reification, and so the property attributes are the same as you would get if you were creating a new property.
> A simple test would be to see if
> Array.prototype.reduce;
> Array.prototype.reduce = ...
> Results in the correct behavior.

I have created a test case here:
Comment 1 John-David Dalton 2011-08-17 23:38:06 PDT
Related V8 issue: