[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198
oliver at apple.com
oliver at apple.com
Sun Feb 20 23:03:32 UTC 2011
The following commit has been merged in the webkit-1.3 branch:
commit 1854231f9b883135bc9eeafd0eeec0c568b02531
Author: oliver at apple.com <oliver at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Sat Jan 15 23:39:36 2011 +0000
2011-01-15 Oliver Hunt <oliver at apple.com>
Reviewed by Maciej Stachowiak.
Incorrect behavior changing attributes of an accessor
https://bugs.webkit.org/show_bug.cgi?id=52515
defineProperty doesn't correctly handle changing attributes of an accessor
property. This is because we don't pass the full descriptor to the
putDescriptor helper function, which means we have insufficient information
to do the right thing. Once that's passed the correct behavior is relatively
simple to implement.
* runtime/JSObject.cpp:
(JSC::putDescriptor):
(JSC::JSObject::defineOwnProperty):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75884 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1b17de2..c4b2cfd 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2011-01-15 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Maciej Stachowiak.
+
+ Incorrect behavior changing attributes of an accessor
+ https://bugs.webkit.org/show_bug.cgi?id=52515
+
+ Add an additional test for validating changing attributes of
+ an accessor property.s
+
+ * fast/js/Object-defineProperty-expected.txt:
+ * fast/js/script-tests/Object-defineProperty.js:
+
2011-01-15 David Kilzer <ddkilzer at apple.com>
<http://webkit.org/b/52512> REGRESSION(r73818): range.cloneContents() ignores end offset
diff --git a/LayoutTests/fast/js/Object-defineProperty-expected.txt b/LayoutTests/fast/js/Object-defineProperty-expected.txt
index fd15c69..f53ff07 100644
--- a/LayoutTests/fast/js/Object-defineProperty-expected.txt
+++ b/LayoutTests/fast/js/Object-defineProperty-expected.txt
@@ -23,6 +23,7 @@ PASS Object.defineProperty('foo') threw exception TypeError: Properties can only
PASS Object.defineProperty({}) threw exception TypeError: Property description must be an object..
PASS Object.defineProperty({}, 'foo') threw exception TypeError: Property description must be an object..
PASS Object.defineProperty({}, 'foo', {get:undefined, value:true}).foo is true
+PASS Object.defineProperty({get foo() { return true; } }, 'foo', {configurable:false}).foo is true
PASS Object.defineProperty(createUnconfigurableProperty({}, 'foo'), 'foo', {configurable: true}) threw exception TypeError: Attempting to configurable attribute of unconfigurable property..
PASS Object.defineProperty(createUnconfigurableProperty({}, 'foo'), 'foo', {writable: true}) threw exception TypeError: Attempting to change writable attribute of unconfigurable property..
PASS Object.defineProperty(createUnconfigurableProperty({}, 'foo'), 'foo', {enumerable: true}) threw exception TypeError: Attempting to change enumerable attribute of unconfigurable property..
diff --git a/LayoutTests/fast/js/script-tests/Object-defineProperty.js b/LayoutTests/fast/js/script-tests/Object-defineProperty.js
index 087af31..5829ad1 100644
--- a/LayoutTests/fast/js/script-tests/Object-defineProperty.js
+++ b/LayoutTests/fast/js/script-tests/Object-defineProperty.js
@@ -31,6 +31,7 @@ shouldThrow("Object.defineProperty('foo')");
shouldThrow("Object.defineProperty({})");
shouldThrow("Object.defineProperty({}, 'foo')");
shouldBeTrue("Object.defineProperty({}, 'foo', {get:undefined, value:true}).foo");
+shouldBeTrue("Object.defineProperty({get foo() { return true; } }, 'foo', {configurable:false}).foo");
function createUnconfigurableProperty(o, prop, writable, enumerable) {
writable = writable || false;
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index f496bb5..07113bf 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,20 @@
+2011-01-15 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Maciej Stachowiak.
+
+ Incorrect behavior changing attributes of an accessor
+ https://bugs.webkit.org/show_bug.cgi?id=52515
+
+ defineProperty doesn't correctly handle changing attributes of an accessor
+ property. This is because we don't pass the full descriptor to the
+ putDescriptor helper function, which means we have insufficient information
+ to do the right thing. Once that's passed the correct behavior is relatively
+ simple to implement.
+
+ * runtime/JSObject.cpp:
+ (JSC::putDescriptor):
+ (JSC::JSObject::defineOwnProperty):
+
2011-01-14 Oliver Hunt <oliver at apple.com>
Reviewed by Maciej Stachowiak.
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 30e40e4..6ecc73f 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -588,10 +588,28 @@ bool JSObject::getPropertyDescriptor(ExecState* exec, const Identifier& property
}
}
-static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& propertyName, PropertyDescriptor& descriptor, unsigned attributes, JSValue oldValue)
+static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& propertyName, PropertyDescriptor& descriptor, unsigned attributes, const PropertyDescriptor& oldDescriptor)
{
if (descriptor.isGenericDescriptor() || descriptor.isDataDescriptor()) {
- target->putWithAttributes(exec, propertyName, descriptor.value() ? descriptor.value() : oldValue, attributes & ~(Getter | Setter));
+ if (descriptor.isGenericDescriptor() && oldDescriptor.isAccessorDescriptor()) {
+ GetterSetter* accessor = new (exec) GetterSetter(exec);
+ if (oldDescriptor.getter()) {
+ attributes |= Getter;
+ accessor->setGetter(asObject(oldDescriptor.getter()));
+ }
+ if (oldDescriptor.setter()) {
+ attributes |= Setter;
+ accessor->setSetter(asObject(oldDescriptor.setter()));
+ }
+ target->putWithAttributes(exec, propertyName, accessor, attributes);
+ return true;
+ }
+ JSValue newValue = jsUndefined();
+ if (descriptor.value())
+ newValue = descriptor.value();
+ else if (oldDescriptor.value())
+ newValue = oldDescriptor.value();
+ target->putWithAttributes(exec, propertyName, newValue, attributes & ~(Getter | Setter));
return true;
}
attributes &= ~ReadOnly;
@@ -608,8 +626,11 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
{
// If we have a new property we can just put it on normally
PropertyDescriptor current;
- if (!getOwnPropertyDescriptor(exec, propertyName, current))
- return putDescriptor(exec, this, propertyName, descriptor, descriptor.attributes(), jsUndefined());
+ if (!getOwnPropertyDescriptor(exec, propertyName, current)) {
+ PropertyDescriptor oldDescriptor;
+ oldDescriptor.setValue(jsUndefined());
+ return putDescriptor(exec, this, propertyName, descriptor, descriptor.attributes(), oldDescriptor);
+ }
if (descriptor.isEmpty())
return true;
@@ -635,7 +656,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
if (descriptor.isGenericDescriptor()) {
if (!current.attributesEqual(descriptor)) {
deleteProperty(exec, propertyName);
- putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value());
+ putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
}
return true;
}
@@ -648,7 +669,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
return false;
}
deleteProperty(exec, propertyName);
- return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value() ? current.value() : jsUndefined());
+ return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
}
// Changing the value and attributes of an existing property
@@ -676,7 +697,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
return true;
}
deleteProperty(exec, propertyName);
- return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value());
+ return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
}
// Changing the accessor functions of an existing accessor property
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list