Bug 78438 – Failed strict assignment to __proto__ not throwing

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[Mark S. Miller]

In Version 5.1.2 (7534.52.7, r107511):

    > var x = Object.preventExtensions({});
    > var y = {};
    > function foo(){"use strict"; x.__proto__ = y;}
    > Object.getPrototypeOf(x) === Object.prototype
    true
    > foo()
    > Object.getPrototypeOf(x) === Object.prototype
    true

The above behavior correctly does not mutate x.__proto__, however, since it is a failed assignment and foo() is strict, the call to foo() should have thrown an exception. Instead it failed silently.

[Mark S. Miller]

See https://bugs.webkit.org/show_bug.cgi?id=65832

[Mark S. Miller]

On Version 5.1.2 (7534.52.7) I get

    > foo()
    TypeError: Attempted to assign to readonly property.

which is correct, so this is a regression.

[Gavin Barraclough]

Ah agreed, we should be following step 3 of your proposal here ( http://wiki.ecmascript.org/doku.php?id=strawman:magic_proto_property ), this will still be a change from our previous behavior, but will be more restrictive rather than less.

Thanks for the bug Mark!

[Gavin Barraclough]

I had to roll out bug#78409 to fix a couple of test cases, when I re-landed it I fixed this too.

There is a test case covering this.  All should hopefully be good now, cheers for the bug report.

*** This bug has been marked as a duplicate of bug 78409 ***