On Fri, Feb 15, 2013 at 5:30 PM, Jeff Walden <[email protected]> wrote:
> Consider:
>
> Object.defineProperty(Object.prototype, "0", { value: 17, writable:
> false, configurable: false });
> [].push(42);
>
> Per ES5, I think this is supposed to throw a TypeError. The push should
> be setting property "0" with Throw = true, which means that when [[CanPut]]
> fails, a TypeError gets thrown. No engine I can test does this, I suspect
> because everyone's mis-implemented an optimization.
FYI, this looks very similar to <
http://code.google.com/p/v8/issues/detail?id=2412>, which is one of the
bugs which SES/Caja is concerned about: Array.prototype.push can mutate a
sealed (but not frozen) object.
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
