[Webkit-unassigned] [Bug 36738] New: JS assignment to an existing property should not change the attributes of the property

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=36738

           Summary: JS assignment to an existing property should not
                    change the attributes of the property
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: phnixwxz at gmail.com


What steps will reproduce the problem?
1. Open the attached HTML file

What is the expected result?
Should alert 'false'.

What happens instead?
Alerts 'true'.

According to ECMA262v3 8.6.2.2 [[Put]] (P, V)
4. Set the value of the property to V. The attributes of the property are 
not changed
so Array.property.push should still have DontEnum attribute after assigned 
another value.

ECMA262v5 8.12.5 3. also implies that the attributes of an existing 
property should be preserved when the property is assigned another value.

This issue causes some compatibility issues. Some web page using for...in 
to enumerate properties of arrays or objects after some default methods are
overridden.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.