[Webkit-unassigned] [Bug 34639] Object.defineProperty accepts wrong descriptor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=34639


Xan Lopez <xan.lopez at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |xan.lopez at gmail.com




--- Comment #2 from Xan Lopez <xan.lopez at gmail.com>  2010-08-22 20:37:30 PST ---
The problem is that as far as the code is concerned there is no difference between not having been set a Getter and having an undefined Getter. If we want to be more subtle we'd need to check the attribute flags of the descriptor, which are modified when a Getter is set. Something like:


diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructo$
index b1f9d70..e47a4e6 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -229,7 +229,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setSetter(set);
     }

-    if (!desc.isAccessorDescriptor())
+    if (!desc.attributes() & Getter || !desc.attributes() & Setter)
         return true;

     if (desc.value()) {

That makes the testcase print 'Yes' here.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.