Don't allow sets to readonly properties (bug 810925, r=kannan).

--HG--
extra : rebase_source : 2eac13774239d9047e7c869c4afab6eeef6f6502
This commit is contained in:
David Anderson 2012-11-15 18:32:57 -08:00
parent bd692e864a
commit 905b8690be

View File

@ -1302,7 +1302,7 @@ IsPropertyAddInlineable(JSContext *cx, HandleObject obj, jsid id, uint32_t oldSl
if (obj->getClass()->resolve != JS_ResolveStub)
return false;
if (!obj->isExtensible())
if (!obj->isExtensible() || !shape->writable())
return false;
// walk up the object prototype chain and ensure that all prototypes