Diff
Modified: trunk/LayoutTests/ChangeLog (104776 => 104777)
--- trunk/LayoutTests/ChangeLog 2012-01-12 01:29:27 UTC (rev 104776)
+++ trunk/LayoutTests/ChangeLog 2012-01-12 01:30:19 UTC (rev 104777)
@@ -1,3 +1,14 @@
+2012-01-11 Gavin Barraclough <[email protected]>
+
+ Object.defineProperty([], 'length', {}) should not make length read-only
+ https://bugs.webkit.org/show_bug.cgi?id=76097
+
+ Reviewed by Oliver Hunt.
+
+ * fast/js/array-defineOwnProperty-expected.txt:
+ * fast/js/script-tests/array-defineOwnProperty.js:
+ - Added test.
+
2012-01-11 Adam Barth <[email protected]>
iframe sandbox doesn't block autofocus (IETC automatic-feature-block-autofocus-form-control)
Modified: trunk/LayoutTests/fast/js/array-defineOwnProperty-expected.txt (104776 => 104777)
--- trunk/LayoutTests/fast/js/array-defineOwnProperty-expected.txt 2012-01-12 01:29:27 UTC (rev 104776)
+++ trunk/LayoutTests/fast/js/array-defineOwnProperty-expected.txt 2012-01-12 01:30:19 UTC (rev 104777)
@@ -7,6 +7,7 @@
PASS Object.defineProperty([], 'length', { value: 1 }).length is 1
PASS var a = Object.defineProperty([], 'length', { writable: false }); a[1] = 1; a.length is 0
PASS var a = Object.defineProperty([], 'length', { writable: false }); a.length = 1; a.length is 0
+PASS var a = Object.defineProperty([], 'length', {}); a.length = 1; a.length is 1
PASS Object.defineProperty([], 'length', { get:function(){return true;} }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.defineProperty([], 'length', { enumerable: true }) threw exception TypeError: Attempting to change enumerable attribute of unconfigurable property..
PASS Object.defineProperty([], 'length', { configurable: true }) threw exception TypeError: Attempting to change configurable attribute of unconfigurable property..
Modified: trunk/LayoutTests/fast/js/script-tests/array-defineOwnProperty.js (104776 => 104777)
--- trunk/LayoutTests/fast/js/script-tests/array-defineOwnProperty.js 2012-01-12 01:29:27 UTC (rev 104776)
+++ trunk/LayoutTests/fast/js/script-tests/array-defineOwnProperty.js 2012-01-12 01:30:19 UTC (rev 104777)
@@ -7,6 +7,8 @@
shouldBe("Object.defineProperty([], 'length', { value: 1 }).length", '1');
shouldBe("var a = Object.defineProperty([], 'length', { writable: false }); a[1] = 1; a.length", '0');
shouldBe("var a = Object.defineProperty([], 'length', { writable: false }); a.length = 1; a.length", '0');
+// If writable is not specified, it should not change.
+shouldBe("var a = Object.defineProperty([], 'length', {}); a.length = 1; a.length", '1');
// The length property can be replaced with an accessor, or made either enumerable or configurable.
shouldThrow("Object.defineProperty([], 'length', { get:function(){return true;} })");
Modified: trunk/Source/_javascript_Core/ChangeLog (104776 => 104777)
--- trunk/Source/_javascript_Core/ChangeLog 2012-01-12 01:29:27 UTC (rev 104776)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-01-12 01:30:19 UTC (rev 104777)
@@ -1,3 +1,14 @@
+2012-01-11 Gavin Barraclough <[email protected]>
+
+ Object.defineProperty([], 'length', {}) should not make length read-only
+ https://bugs.webkit.org/show_bug.cgi?id=76097
+
+ Reviewed by Oliver Hunt.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::defineOwnProperty):
+ - We should be checking writablePresent().
+
2012-01-11 Filip Pizlo <[email protected]>
Code duplication for invoking the JIT and DFG should be reduced
Modified: trunk/Source/_javascript_Core/runtime/JSArray.cpp (104776 => 104777)
--- trunk/Source/_javascript_Core/runtime/JSArray.cpp 2012-01-12 01:29:27 UTC (rev 104776)
+++ trunk/Source/_javascript_Core/runtime/JSArray.cpp 2012-01-12 01:30:19 UTC (rev 104777)
@@ -531,10 +531,10 @@
if (propertyName == exec->propertyNames().length) {
// All paths through length definition call the default [[DefineOwnProperty]], hence:
// from ES5.1 8.12.9 7.a.
- if (descriptor.configurable())
+ if (descriptor.configurablePresent() && descriptor.configurable())
return reject(exec, throwException, "Attempting to change configurable attribute of unconfigurable property.");
// from ES5.1 8.12.9 7.b.
- if (descriptor.enumerable())
+ if (descriptor.enumerablePresent() && descriptor.enumerable())
return reject(exec, throwException, "Attempting to change enumerable attribute of unconfigurable property.");
// a. If the [[Value]] field of Desc is absent, then
@@ -542,11 +542,12 @@
if (descriptor.isAccessorDescriptor())
return reject(exec, throwException, "Attempting to change access mechanism for an unconfigurable property.");
// from ES5.1 8.12.9 10.a.
- if (!array->isLengthWritable() && descriptor.writable())
+ if (!array->isLengthWritable() && descriptor.writablePresent() && descriptor.writable())
return reject(exec, throwException, "Attempting to change writable attribute of unconfigurable property.");
// This descriptor is either just making length read-only, or changing nothing!
if (!descriptor.value()) {
- array->setLengthWritable(exec, descriptor.writable());
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
return true;
}
@@ -561,7 +562,8 @@
// Based on SameValue check in 8.12.9, this is always okay.
if (newLen == array->length()) {
- array->setLengthWritable(exec, descriptor.writable());
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
return true;
}
@@ -588,13 +590,17 @@
// 2. If newWritable is false, set newLenDesc.[[Writable] to false.
// 3. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and false as arguments.
// 4. Reject.
- array->setLengthWritable(exec, descriptor.writable());
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
return false;
}
// m. If newWritable is false, then
- // i. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", Property Descriptor{[[Writable]]: false}, and false as arguments. This call will always return true.
- array->setLengthWritable(exec, descriptor.writable());
+ // i. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length",
+ // Property Descriptor{[[Writable]]: false}, and false as arguments. This call will always
+ // return true.
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
// n. Return true.
return true;
}
