Bug 75935 - Do not allow Array length to be set if it is non-configurable
Summary: Do not allow Array length to be set if it is non-configurable
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-01-09 21:15 PST by Gavin Barraclough
Modified: 2012-01-10 13:02 PST (History)
0 users

See Also:

Attachments
Fix (18.32 KB, patch)
2012-01-09 22:11 PST, Gavin Barraclough 		sam: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2012-01-09 21:15:49 PST 
Do not allow Array length to be set if it is non-configurable, and if the new length is less than the old length then intervening properties should removed in reverse order.  Removal of properties should cease if an intervening indexed  property being removed is non-configurable.
Comment 1 Gavin Barraclough 2012-01-09 22:11:32 PST 
Created attachment 121793 [details]
Fix

No performance impact.
Comment 2 Gavin Barraclough 2012-01-10 11:28:01 PST 
Fixed in r104604
Comment 3 Gavin Barraclough 2012-01-10 13:02:23 PST 
32-bit build fix in r104620