Commit fb498f4b authored by barraclough@apple.com's avatar barraclough@apple.com
Browse files

https://bugs.webkit.org/show_bug.cgi?id=97530

Regression, freeze applied to numeric properties of non-array objects

Reviewed by Filip Pizlo.

Object.freeze has a fast implementation in JSObject, but this hasn't been updated to take into account numeric properties in butterflies.
For now, just fall back to the generic implementation if the object has numeric properties.

Source/JavaScriptCore: 

* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorFreeze):
    - fallback if the object has a non-zero indexed property vector length.

LayoutTests: 

* fast/js/preventExtensions-expected.txt:
* fast/js/script-tests/preventExtensions.js:
    - Added a test case for freezing an object with a numeric property.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129461 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 07e2e0bf
2012-09-24 Gavin Barraclough <barraclough@apple.com>
https://bugs.webkit.org/show_bug.cgi?id=97530
Regression, freeze applied to numeric properties of non-array objects
Reviewed by Filip Pizlo.
Object.freeze has a fast implementation in JSObject, but this hasn't been updated to take into account numeric properties in butterflies.
For now, just fall back to the generic implementation if the object has numeric properties.
* fast/js/preventExtensions-expected.txt:
* fast/js/script-tests/preventExtensions.js:
- Added a test case for freezing an object with a numeric property.
2012-09-24 Zan Dobersek <zandobersek@gmail.com>
 
Unreviewed GTK gardening.
......@@ -35,6 +35,8 @@ PASS preventExtensionsFreezeIsFrozen(function foo(){}) is true
PASS preventExtensionsFreezeIsFrozen(function foo(){ "use strict"; }) is true
PASS preventExtensionsFreezeIsFrozen([0,1,2]) is true
PASS preventExtensionsFreezeIsFrozen((function(){ return arguments; })(0,1,2)) is true
PASS Object.getOwnPropertyDescriptor(freeze({0:0}), 0).configurable is false
PASS Object.getOwnPropertyDescriptor(freeze({10000001:0}), 10000001).configurable is false
PASS successfullyParsed is true
TEST COMPLETE
......
......@@ -130,3 +130,5 @@ shouldBeTrue('preventExtensionsFreezeIsFrozen(function foo(){ "use strict"; })')
shouldBeTrue('preventExtensionsFreezeIsFrozen([0,1,2])')
shouldBeTrue('preventExtensionsFreezeIsFrozen((function(){ return arguments; })(0,1,2))')
shouldBeFalse('Object.getOwnPropertyDescriptor(freeze({0:0}), 0).configurable');
shouldBeFalse('Object.getOwnPropertyDescriptor(freeze({10000001:0}), 10000001).configurable');
2012-09-24 Gavin Barraclough <barraclough@apple.com>
https://bugs.webkit.org/show_bug.cgi?id=97530
Regression, freeze applied to numeric properties of non-array objects
Reviewed by Filip Pizlo.
Object.freeze has a fast implementation in JSObject, but this hasn't been updated to take into account numeric properties in butterflies.
For now, just fall back to the generic implementation if the object has numeric properties.
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorFreeze):
- fallback if the object has a non-zero indexed property vector length.
2012-09-24 Gavin Barraclough <barraclough@apple.com>
 
Bug in numeric accessors on global environment
......
......@@ -404,7 +404,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState* exec)
return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.freeze can only be called on Objects.")));
JSObject* object = asObject(obj);
if (isJSFinalObject(object)) {
if (isJSFinalObject(object) && !hasIndexedProperties(object->structure()->indexingType())) {
object->freeze(exec->globalData());
return JSValue::encode(obj);
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment