Title: [107957] trunk
- Revision
- 107957
- Author
- [email protected]
- Date
- 2012-02-16 11:08:01 -0800 (Thu, 16 Feb 2012)
Log Message
Numerous trivial bugs in Object.defineProperty
https://bugs.webkit.org/show_bug.cgi?id=78777
Reviewed by Sam Weinig.
There are a handful of really trivial bugs, related to Object.defineProperty:
* Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
* Calling an undefined setter should only throw in strict mode.
* When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
* Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
* Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
* If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
* 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
* Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
* Should be able to define an non-configurable accessor.
These are mostly all one-line changes, e.g. inverted boolean checks, masking against wrong attribute.
Source/_javascript_Core:
* runtime/JSArray.cpp:
(JSC::SparseArrayValueMap::put):
- Added ASSERT.
- Calling an undefined setter should only throw in strict mode.
(JSC::JSArray::putDescriptor):
- Should be able to define an non-configurable accessor.
(JSC::JSArray::defineOwnNumericProperty):
- Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
(JSC::JSArray::putByIndexBeyondVectorLength):
- If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
* runtime/JSArray.h:
(JSArray):
- made enterDictionaryMode public, called from JSObject.
* runtime/JSObject.cpp:
(JSC::JSObject::put):
- Calling an undefined setter should only throw in strict mode.
(JSC::JSObject::preventExtensions):
- Put array objects into dictionary mode to handle this!
(JSC::JSObject::defineOwnProperty):
- Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
- Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorDefineProperties):
- Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::attributesWithOverride):
- When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
(JSC::PropertyDescriptor::attributesOverridingCurrent):
- When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
* runtime/Structure.cpp:
(JSC::Structure::freezeTransition):
- 'freezeTransition' shouldn't be setting the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
(JSC::Structure::isFrozen):
- 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
LayoutTests:
* fast/js/Object-defineProperties-expected.txt:
* fast/js/Object-defineProperty-expected.txt:
* fast/js/preventExtensions-expected.txt:
* fast/js/property-getters-and-setters-expected.txt:
* fast/js/script-tests/Object-defineProperty.js:
* fast/js/script-tests/preventExtensions.js:
* fast/js/script-tests/property-getters-and-setters.js:
- Update result & add new test cases for all bugs fixed.
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (107956 => 107957)
--- trunk/LayoutTests/ChangeLog 2012-02-16 19:06:03 UTC (rev 107956)
+++ trunk/LayoutTests/ChangeLog 2012-02-16 19:08:01 UTC (rev 107957)
@@ -1,4 +1,3 @@
-<<<<<<< .mine
2012-02-15 Gavin Barraclough <[email protected]>
Numerous trivial bugs in Object.defineProperty
@@ -27,7 +26,6 @@
* fast/js/script-tests/property-getters-and-setters.js:
- Update result & add new test cases for all bugs fixed.
-=======
2012-02-16 Terry Anderson <[email protected]>
WebKit does not support DOM 3 Events FocusEvent
@@ -696,7 +694,6 @@
* platform/chromium/compositing/overflow/overflow-scrolling-touch-stacking-context-expected.txt: Added.
* platform/chromium/compositing/overflow/overflow-scrolling-touch-stacking-context.html: Added.
->>>>>>> .r107955
2012-02-15 Alexey Proskuryakov <[email protected]>
Crash after trying to use FileReader in a document with null origin string
Modified: trunk/Source/_javascript_Core/ChangeLog (107956 => 107957)
--- trunk/Source/_javascript_Core/ChangeLog 2012-02-16 19:06:03 UTC (rev 107956)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-02-16 19:08:01 UTC (rev 107957)
@@ -1,4 +1,3 @@
-<<<<<<< .mine
2012-02-15 Gavin Barraclough <[email protected]>
Numerous trivial bugs in Object.defineProperty
@@ -53,7 +52,6 @@
(JSC::Structure::isFrozen):
- 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
-=======
2012-02-13 Filip Pizlo <[email protected]>
DFG should not check the types of arguments that are dead
@@ -70,7 +68,6 @@
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
->>>>>>> .r107954
2012-02-15 Oliver Hunt <[email protected]>
Ensure that the DFG JIT always plants a CodeOrigin when making calls
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
