Bug 72766 - Setting a property on an object whose prototype has a readonly property of the same name should not work
Summary: Setting a property on an object whose prototype has a readonly property of th...
Status: RESOLVED DUPLICATE of bug 79069
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-11-18 15:18 PST by Boris Zbarsky
Modified: 2012-03-01 02:20 PST (History)
3 users (show)

See Also:


Attachments
Testcase (503 bytes, text/plain)
2011-11-18 15:18 PST, Boris Zbarsky
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Boris Zbarsky 2011-11-18 15:18:47 PST
Created attachment 115885 [details]
Testcase

The attached testcase should print "PASS" twice.  Instead, it prints "FAIL" twice in JavaScriptCore.

The relevant analysis per ECMA-262 follows:

1) Per section 15.2.3.9, Object.freeze reconfigures data properties not
   be writable.
2) Per section 11.13.1, setting "test_instance.x = 'hello'" calls
   PutValue() with "test_instance.x" as the first argument.
3) Per section 8.7.2 step 4 the [[Put]] internal method of
   test_instance is called.  IsStrictReference is true if an only if
   the code is in strict mode.
4) Per section 8.12.5 step 1, the [[CanPut]] internal method of
   test_instance is called.
5) Per section 8.12.4 step 1, [[GetOwnProperty]] is called on
   test_instance; in this case it returns undefined, so step 2 is
   skipped.
6) Per section 8.12.4 step 5 [[GetProperty]] is called on the prototype
   and returns a data descriptor for a non-writable data property.
7) Per section 8.12.4 step 8b, [[CanPut]] returns false.
8) Per section 8.12.5 step 1, either a TypeError is thrown or the set
   is ignored, depending on whether the code is in strict mode.

JavaScriptCore most certainly doesn't do the above.

SpiderMonkey gets this right.
Comment 1 Boris Zbarsky 2011-11-19 13:58:29 PST
Step 2 should be:

2) Per section 11.13.1, setting "test_instance.x" calls
   PutValue() with "test_instance.x" as the first argument.
Comment 2 Gavin Barraclough 2012-03-01 02:20:24 PST
This has been fixed in r108304.

*** This bug has been marked as a duplicate of bug 79069 ***