wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1148750, part 12 - Reject redefinition of non-writable non-configurable data property as writable. This fixes bug 1073808. r=efaust.

Browse Source
This commit is contained in:
Jason Orendorff 2015-04-09 15:55:37 -05:00
parent 296a9c02e1
commit 7189237c72
3 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jit-test/tests/collections/Array-of-nonconfigurable-1.js Normal file
View File

@ -0,0 +1,8 @@
// If Array.of tries to overwrite a non-configurable property, it throws a TypeError.
load(libdir + "asserts.js");
function C() {
Object.defineProperty(this, 0, {value: "v", configurable: false});
}
assertThrowsInstanceOf(() => Array.of.call(C, 1, 2, 3), TypeError);

16
js/src/jit-test/tests/collections/Array-of-nonconfigurable-2.js Normal file
View File

@ -0,0 +1,16 @@
// Array.of does not overwrite non-configurable properties.
load(libdir + "asserts.js");
var obj;
function C() {
obj = this;
Object.defineProperty(this, 0, {value: "v", configurable: false});
}
try { Array.of.call(C, 1); } catch (e) {}
assertDeepEq(Object.getOwnPropertyDescriptor(obj, 0), {
configurable: false,
enumerable: false,
value: "v",
writable: false
});

4
js/src/vm/NativeObject.cpp
View File

@ -1443,6 +1443,10 @@ js::NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId
CompletePropertyDescriptor(&desc);
} else if (desc.isDataDescriptor()) {
// Step 8.
bool frozen = !IsConfigurable(shapeAttrs) && !IsWritable(shapeAttrs);
if (frozen && desc.hasWritable() && desc.writable() && !skipRedefineChecks)
return result.fail(JSMSG_CANT_REDEFINE_PROP);
if (desc.hasValue()) {
// If any other JSPROP_IGNORE_* attributes are present, copy the
// corresponding JSPROP_* attributes from the existing property.