[Webkit-unassigned] [Bug 125307] New: DOM objects violate fundamental ES6 invariants

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=125307

           Summary: DOM objects violate fundamental ES6 invariants
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: bzbarsky at mit.edu


Given this markup:

  <div>TEXT</div>

this script:

  function serializeDescriptor(desc) {
    var str = "{ ";
    for (var prop in desc) {
      str += prop + ": " + desc[prop] + "; "
    }
    return str + "}"
  }
  var div = document.querySelector("div");
  document.writeln("firstChild descriptor: " +
                   serializeDescriptor(Object.getOwnPropertyDescriptor(div, "firstChild")));

outputs:

  firstChild descriptor: { value: [object Text]; writable: false; enumerable: true; configurable: false; }

In ES6 section 6.1.7.3 (Invariants of the Essential Internal Methods) says:

  The [[GetOwnProperty]] internal method of all objects must conform to the following invariants
  for each property of the object:
...
    If a property is described as a data property and its [[Writable]] and [[Configurable]] are
    both false, then the SameValue (according to 7.2.3) must be returned for the [[Value]]
    attribute of the property on all calls to [[GetOwnProperty]].

However simply running div.removeChild(div.firstChild) makes the object's [[GetOwnProperty]] return a descriptor with a different [[Value]].

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.