[Webkit-unassigned] [Bug 80577] New: Object.freeze broken on latest Nightly

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=80577

           Summary: Object.freeze broken on latest Nightly
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Major
          Priority: P1
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: erights at gmail.com


When executing the following three lines on Safari Version 5.1.3 (7534.53.10), the last correctly returned true. On WebKit Nightly Version 5.1.3 (7534.53.10, r110098), it gives false, which is wrong.

> function foo(){}
> Object.freeze(foo);
> Object.isFrozen(foo);

The problem seems to be the prototype property. On WebKit Nightly

> JSON.stringify(Object.getOwnPropertyDescriptor(foo, 'prototype'))
{"value":{},"writable":true,"enumerable":false,"configurable":false}

On Safari, we instead get the correct "writable":false

For some reason, it seems this same problem manifests differently on http://es-lab.googlecode.com/svn/trunk/src/ses/explicit.html

When freezing a particular function with a writable non-configurable prototype, this page now throws 

      "TypeError: Attempting to change access mechanism for an unconfigurable property" 

on this latest Nightly. It did not do so on last night's Nightly. From the nature of this symptom, I'm not sure that the problem is with the 'prototype' property specifically, since the error doesn't say what property it is complaining about. Regardless, it is never correct from Object.freeze itself to fail because of (non) configurability. All the state changes it causes are always allowed.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.