[Webkit-unassigned] [Bug 34639] New: Object.defineProperty accepts wrong descriptor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=34639

           Summary: Object.defineProperty accepts wrong descriptor
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ricow at google.com


The JavaScript:
Object.defineProperty({}, 'foo', {get:undefined, value:42})
According to spec ToPropertyDescriptor (8.10.5),
which is called from Object.defineProperty (15.2.3.6) with argument
{get:undefined, value:true} should in this case throw an exception: 
step 5 will set desc.value to true
step 6 will set desc.get to undefined
step 9 should in this case throw an exception since desc.get is present
(although undefined)

Attached js file should produce:

Yes

It produces:

No

This bug was experienced using JSC 54131 from 2010-02-01

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.