• barraclough@apple.com's avatar
    Fix Object.freeze for non-final objects. · 2668db93
    barraclough@apple.com authored
    https://bugs.webkit.org/show_bug.cgi?id=79286
    
    Reviewed by Oliver Hunt.
    
    For vanilla objects we implement this with a single transition, for objects
    with special properties we should just follow the spec defined algorithm.
    
    Source/JavaScriptCore: 
    
    * runtime/JSArray.cpp:
    (JSC::SparseArrayValueMap::put):
        - this does need to handle inextensible objects.
    * runtime/ObjectConstructor.cpp:
    (JSC::objectConstructorSeal):
    (JSC::objectConstructorFreeze):
        - Implement spec defined algorithm for non-final objects.
    * runtime/Structure.cpp:
    (JSC::Structure::Structure):
    (JSC::Structure::freezeTransition):
        - freeze should set m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
    * runtime/Structure.h:
    (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
    (JSC::Structure::setHasGetterSetterProperties):
    (JSC::Structure::setContainsReadOnlyProperties):
    (Structure):
        - renamed m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
    
    LayoutTests: 
    
    * fast/js/preventExtensions-expected.txt:
    * fast/js/script-tests/preventExtensions.js:
        - added new tests.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108568 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    2668db93
JSArray.cpp 72.4 KB