Bug 141951

Summary: Our bizarre behavior on Arguments::defineOwnProperty should be deliberate rather than a spaghetti incident
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, benjamin, ggaren, mark.lam, mhahnenb, mmirman, msaboff, nrotem, oliver, saam, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on:    
Bug Blocks: 141952, 141174    
Attachments:
Description Flags
WRONG PATCH
none
the patch
none
the patch benjamin: review+

Filip Pizlo
Reported 2015-02-23 21:10:54 PST
Patch forthcoming.
Attachments
WRONG PATCH (102.66 KB, patch)
2015-02-23 21:19 PST, Filip Pizlo 		no flags
DetailsFormatted DiffDiff
the patch (8.23 KB, patch)
2015-02-23 21:19 PST, Filip Pizlo 		no flags
DetailsFormatted DiffDiff
the patch (8.41 KB, patch)
2015-02-23 21:27 PST, Filip Pizlo 		benjamin: review+
DetailsFormatted DiffDiff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2015-02-23 21:19:14 PST
Created attachment 247199 [details] WRONG PATCH
Filip Pizlo
Comment 2 2015-02-23 21:19:54 PST
Created attachment 247200 [details] the patch
Filip Pizlo
Comment 3 2015-02-23 21:23:04 PST
Comment on attachment 247200 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=247200&action=review > Source/JavaScriptCore/runtime/Arguments.cpp:308 > + // ignore the request to change enumerability. We appear to have always do so, in "*We appear to have always done [sic] so" I changed this locally.
Filip Pizlo
Comment 4 2015-02-23 21:26:52 PST
Comment on attachment 247200 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=247200&action=review > Source/JavaScriptCore/tests/stress/arguments-bizarre-behaviour-disable-enumerability.js:25 > +function foo(x) { > + Object.defineProperty(arguments, 0, {configurable: true, enumerable: true, writable:true, value:42}); > + return [x, arguments[0], arguments] > +} > + > +var result = foo(1); > + > +if (result[0] !== 42) > + throw new Error(); > + > +if (result[1] !== 42) > + throw new Error(); > + > +if (Array.prototype.join.call(result[2], ",") != "42") > + throw new Error(); > + > +var array = []; > +for (var s in result[2]) > + array.push(s); > + > +if (array.join(",") != "0") > + throw new Error(); > + > +if (Object.keys(result[2]).join(",") != "0") > + throw new Error(); This was meant to be a different test, that sets enumerable to false. I messed up when copying files around...
Filip Pizlo
Comment 5 2015-02-23 21:27:36 PST
Created attachment 247201 [details] the patch
Benjamin Poulain
Comment 6 2015-02-23 21:42:11 PST
Comment on attachment 247201 [details] the patch ok
Filip Pizlo
Comment 7 2015-02-24 09:14:31 PST
Landed in http://trac.webkit.org/changeset/180564
Note You need to log in before you can comment on or make changes to this bug.