Bug 1357462 - Throw TypeError early when a property is non-writable. r=jandem
authorAndré Bargull <andre.bargull@gmail.com>
Wed, 19 Apr 2017 05:53:50 -0700
changeset 403219 27114f4cd6e7a306139d59a9b959e0183e5613ab
parent 403218 0f97f76c0b34673f2bf31c96eb1285416836f565
child 403220 6fbda056532ebc49e993d169799e2b19205b36ba
push id7391
push usermtabara@mozilla.com
push dateMon, 12 Jun 2017 13:08:53 +0000
treeherdermozilla-beta@2191d7f87e2e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1357462
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1357462 - Throw TypeError early when a property is non-writable. r=jandem
js/src/jit-test/tests/auto-regress/bug1357462.js
js/src/vm/NativeObject.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1357462.js
@@ -0,0 +1,6 @@
+var p = Object.freeze(["old-value"]);
+var a = Object.setPrototypeOf([], p);
+
+assertEq(p[0], "old-value");
+assertEq(Reflect.set(a, 0, "new-value", p), false);
+assertEq(p[0], "old-value");
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -2367,17 +2367,17 @@ SetDenseOrTypedArrayElement(JSContext* c
 static bool
 SetExistingProperty(JSContext* cx, HandleNativeObject obj, HandleId id, HandleValue v,
                     HandleValue receiver, HandleNativeObject pobj, Handle<PropertyResult> prop,
                     ObjectOpResult& result)
 {
     // Step 5 for dense elements.
     if (prop.isDenseOrTypedArrayElement()) {
         // Step 5.a.
-        if (obj->getElementsHeader()->isFrozen())
+        if (pobj->getElementsHeader()->isFrozen())
             return result.fail(JSMSG_READ_ONLY);
 
         // Pure optimization for the common case:
         if (receiver.isObject() && pobj == &receiver.toObject())
             return SetDenseOrTypedArrayElement(cx, pobj, JSID_TO_INT(id), v, result);
 
         // Steps 5.b-f.
         return SetPropertyByDefining(cx, id, v, receiver, result);