[Webkit-unassigned] [Bug 34639] Object.defineProperty accepts wrong descriptor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=34639





--- Comment #3 from Xan Lopez <xan.lopez at gmail.com>  2010-08-22 20:50:11 PST ---
We want to check if both are not present, actually:


diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index b1f9d70..3537576 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -229,7 +229,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setSetter(set);
     }

-    if (!desc.isAccessorDescriptor())
+    if (!(desc.attributes() & Getter || desc.attributes() & Setter))
         return true;

     if (desc.value()) {

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.