[Webkit-unassigned] [Bug 184629] New: Object.defineProperty is not called when it sets an object attribute that exists

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184629

            Bug ID: 184629
           Summary: Object.defineProperty is not called when it sets an
                    object attribute that exists
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: isol2 at cin.ufpe.br

Hi everyone,

I found a case of inconsistent assertions violated in this test case.

Tag: 606.1.9.4
OS: ubuntu 16.04 x86

Reproduce steps:
- Run this code:
    var def = [];
    var p = new Proxy({foo:1, bar:2}, { defineProperty: function(o, v, desc) { def.push(v); Object.defineProperty(o, v, desc); return true; }});
    p.foo = 2; p.bar = 4;
    p.foo = 2; p.bar = 4;
    p.foo = 2; p.bar = 4;
    print(def + '' === "foo,bar");

Expected results
false

Actual results
true


JSCore should record all calls to setters "foo" and "bar" (six in total), whose expected effect is to store the string "foo,bar,foo,bar,foo,bar" on variable "def". Therefore, the test should fail under JSCore as it fails in other engines (V8, SpiderMonkey and Chakra) --return value should be true as per test assertion. However, JSCore only stores the first two calls to the setters and the test (incorrectly) passes.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180414/8cda7b99/attachment.html>