[Webkit-unassigned] [Bug 266611] Object.defineProperties fast path causes values to be assigned to incorrect property

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=266611

Dylan Conway <dylan.conway567 at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dylan.conway567 at gmail.com

--- Comment #1 from Dylan Conway <dylan.conway567 at gmail.com> ---
repro:
```
class InterfaceConstructor {
  two() {}
}

class Interface {}

Object.defineProperties(Interface.prototype, {
  one: {
    __proto__: null,
  },

  two: {
    value: InterfaceConstructor.prototype.two,
  },
});

var interface = new Interface();

print(typeof interface.two);
```

expected print() output:
function

received print() output:
undefined

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20231221/8551163e/attachment.htm>