Bug 80577 - Object.freeze broken on latest Nightly
Summary: Object.freeze broken on latest Nightly
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Major
Assignee: Gavin Barraclough
URL: http://es-lab.googlecode.com/svn/trun...
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-07 23:51 PST by Mark S. Miller
Modified: 2012-03-19 14:40 PDT (History)
3 users (show)

See Also:


Attachments
Fix (5.12 KB, patch)
2012-03-09 18:50 PST, Gavin Barraclough
oliver: review+
Details | Formatted Diff | Diff
More fixed! (12.99 KB, patch)
2012-03-19 14:03 PDT, Gavin Barraclough
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark S. Miller 2012-03-07 23:51:56 PST
When executing the following three lines on Safari Version 5.1.3 (7534.53.10), the last correctly returned true. On WebKit Nightly Version 5.1.3 (7534.53.10, r110098), it gives false, which is wrong.

> function foo(){}
> Object.freeze(foo);
> Object.isFrozen(foo);

The problem seems to be the prototype property. On WebKit Nightly

> JSON.stringify(Object.getOwnPropertyDescriptor(foo, 'prototype'))
{"value":{},"writable":true,"enumerable":false,"configurable":false}

On Safari, we instead get the correct "writable":false

For some reason, it seems this same problem manifests differently on http://es-lab.googlecode.com/svn/trunk/src/ses/explicit.html

When freezing a particular function with a writable non-configurable prototype, this page now throws 

      "TypeError: Attempting to change access mechanism for an unconfigurable property" 

on this latest Nightly. It did not do so on last night's Nightly. From the nature of this symptom, I'm not sure that the problem is with the 'prototype' property specifically, since the error doesn't say what property it is complaining about. Regardless, it is never correct from Object.freeze itself to fail because of (non) configurability. All the state changes it causes are always allowed.
Comment 1 Gavin Barraclough 2012-03-08 13:56:21 PST
Ugh, will look into this.  I'm guessing this is related to the fact the prototype property is added lazily, but haven't figured out exactly what went wrong here.

Cheers for the bug report Mark.
Comment 2 Gavin Barraclough 2012-03-09 18:50:43 PST
Created attachment 131147 [details]
Fix
Comment 3 Gavin Barraclough 2012-03-11 11:58:25 PDT
Fixed in r110396
Comment 4 Mark S. Miller 2012-03-12 04:24:01 PDT
On r110411 visiting http://es-lab.googlecode.com/svn/trunk/src/ses/explicit.html I'm still seeing

    TypeError: Attempting to change access mechanism for an unconfigurable property

thrown when freezing a function. Reopening.
Comment 5 Gavin Barraclough 2012-03-12 10:00:52 PDT
Gah, I bet I know what this is.  The problem is probably preventExtension then freeze.
Comment 6 Gavin Barraclough 2012-03-19 14:03:07 PDT
Created attachment 132663 [details]
More fixed!
Comment 7 Gavin Barraclough 2012-03-19 14:40:12 PDT
Fixed in r111250 - last time I forgot to check http://eslab.googlecode.com/svn/trunk/src/ses/explicit.html - this time I did, & looks like all is good, so hopefully this bug is fully fixed now!

Thanks for the bug report Mark, cheers, G.