Status: Accepted
Owner: [email protected]
CC: [email protected]
Labels: Type-Defect Priority-Medium
New issue 1360 by [email protected]: es53.js doesn't follow the [[CanPut]]
logic correctly
http://code.google.com/p/google-caja/issues/detail?id=1360
Objects inheriting from a prototype with a read-only property can only mask
that property via Object.defineProperty, not by assignment.
function F(){}
Object.defineProperty(F.prototype, 'constructor', {writable:false});
var G = function G(){};
G.prototype = Object.create(F.prototype);
G.prototype.constructor = G;
cajaVM.log(G.prototype.constructor);
Should return F according to 8.12.4 step 8b., but returns G.
