[Webkit-unassigned] [Bug 15003] The "constructor" property on Function.prototype should not be DontDelete/ReadOnly

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=15003





------- Comment #3 from jwalden+bwo at mit.edu  2007-12-29 20:52 PDT -------
(In reply to comment #2)
> In the DontDelete test: I don't understand why the instance's constructor
> property would become Object.prototype.constructor instead of being removed
> altogether.

It *is* removed, but you're only removing it from c.prototype, which per 13.2.2
step 4 and 13.2 steps 9-11 is a value created as if by new Object().  That
object has as its prototype the Object prototype object (15.2.4), which has a
constructor property which is Object.prototype.constructor, i.e. the built-in
Object constructor (15.2.4.1), so getting the constructor property of |new c()|
won't find it on that object, won't find it on the auto-created prototype, but
will find it on Object.prototype.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.