Changeset 104777 in webkit


Ignore:
Timestamp:
Jan 11, 2012 5:30:19 PM (12 years ago)
Author:
barraclough@apple.com
Message:

Object.defineProperty([], 'length', {}) should not make length read-only
https://bugs.webkit.org/show_bug.cgi?id=76097

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

  • runtime/JSArray.cpp:

(JSC::JSArray::defineOwnProperty):

  • We should be checking writablePresent().

LayoutTests:

  • fast/js/array-defineOwnProperty-expected.txt:
  • fast/js/script-tests/array-defineOwnProperty.js:
    • Added test.
Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r104775 r104777  
     12012-01-11  Gavin Barraclough  <barraclough@apple.com>
     2
     3        Object.defineProperty([], 'length', {}) should not make length read-only
     4        https://bugs.webkit.org/show_bug.cgi?id=76097
     5
     6        Reviewed by Oliver Hunt.
     7
     8        * fast/js/array-defineOwnProperty-expected.txt:
     9        * fast/js/script-tests/array-defineOwnProperty.js:
     10            - Added test.
     11
    1122012-01-11  Adam Barth  <abarth@webkit.org>
    213
  • trunk/LayoutTests/fast/js/array-defineOwnProperty-expected.txt

    r104604 r104777  
    88PASS var a = Object.defineProperty([], 'length', { writable: false }); a[1] = 1; a.length is 0
    99PASS var a = Object.defineProperty([], 'length', { writable: false }); a.length = 1; a.length is 0
     10PASS var a = Object.defineProperty([], 'length', {}); a.length = 1; a.length is 1
    1011PASS Object.defineProperty([], 'length', { get:function(){return true;} }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
    1112PASS Object.defineProperty([], 'length', { enumerable: true }) threw exception TypeError: Attempting to change enumerable attribute of unconfigurable property..
  • trunk/LayoutTests/fast/js/script-tests/array-defineOwnProperty.js

    r104604 r104777  
    88shouldBe("var a = Object.defineProperty([], 'length', { writable: false }); a[1] = 1; a.length", '0');
    99shouldBe("var a = Object.defineProperty([], 'length', { writable: false }); a.length = 1; a.length", '0');
     10// If writable is not specified, it should not change.
     11shouldBe("var a = Object.defineProperty([], 'length', {}); a.length = 1; a.length", '1');
    1012
    1113// The length property can be replaced with an accessor, or made either enumerable or configurable.
  • trunk/Source/JavaScriptCore/ChangeLog

    r104774 r104777  
     12012-01-11  Gavin Barraclough  <barraclough@apple.com>
     2
     3        Object.defineProperty([], 'length', {}) should not make length read-only
     4        https://bugs.webkit.org/show_bug.cgi?id=76097
     5
     6        Reviewed by Oliver Hunt.
     7
     8        * runtime/JSArray.cpp:
     9        (JSC::JSArray::defineOwnProperty):
     10            - We should be checking writablePresent().
     11
    1122012-01-11  Filip Pizlo  <fpizlo@apple.com>
    213
  • trunk/Source/JavaScriptCore/runtime/JSArray.cpp

    r104620 r104777  
    532532        // All paths through length definition call the default [[DefineOwnProperty]], hence:
    533533        // from ES5.1 8.12.9 7.a.
    534         if (descriptor.configurable())
     534        if (descriptor.configurablePresent() && descriptor.configurable())
    535535            return reject(exec, throwException, "Attempting to change configurable attribute of unconfigurable property.");
    536536        // from ES5.1 8.12.9 7.b.
    537         if (descriptor.enumerable())
     537        if (descriptor.enumerablePresent() && descriptor.enumerable())
    538538            return reject(exec, throwException, "Attempting to change enumerable attribute of unconfigurable property.");
    539539
     
    543543            return reject(exec, throwException, "Attempting to change access mechanism for an unconfigurable property.");
    544544        // from ES5.1 8.12.9 10.a.
    545         if (!array->isLengthWritable() && descriptor.writable())
     545        if (!array->isLengthWritable() && descriptor.writablePresent() && descriptor.writable())
    546546            return reject(exec, throwException, "Attempting to change writable attribute of unconfigurable property.");
    547547        // This descriptor is either just making length read-only, or changing nothing!
    548548        if (!descriptor.value()) {
    549             array->setLengthWritable(exec, descriptor.writable());
     549            if (descriptor.writablePresent())
     550                array->setLengthWritable(exec, descriptor.writable());
    550551            return true;
    551552        }
     
    562563        // Based on SameValue check in 8.12.9, this is always okay.
    563564        if (newLen == array->length()) {
    564             array->setLengthWritable(exec, descriptor.writable());
     565            if (descriptor.writablePresent())
     566                array->setLengthWritable(exec, descriptor.writable());
    565567            return true;
    566568        }
     
    589591            // 3. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and false as arguments.
    590592            // 4. Reject.
     593            if (descriptor.writablePresent())
     594                array->setLengthWritable(exec, descriptor.writable());
     595            return false;
     596        }
     597
     598        // m. If newWritable is false, then
     599        // i. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length",
     600        //    Property Descriptor{[[Writable]]: false}, and false as arguments. This call will always
     601        //    return true.
     602        if (descriptor.writablePresent())
    591603            array->setLengthWritable(exec, descriptor.writable());
    592             return false;
    593         }
    594 
    595         // m. If newWritable is false, then
    596         // i. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", Property Descriptor{[[Writable]]: false}, and false as arguments. This call will always return true.
    597         array->setLengthWritable(exec, descriptor.writable());
    598604        // n. Return true.
    599605        return true;
Note: See TracChangeset for help on using the changeset viewer.