Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (93141 => 93142)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-08-16 19:34:30 UTC (rev 93141)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-08-16 19:40:10 UTC (rev 93142)
@@ -1,3 +1,18 @@
+2011-08-16 Lucas Forschler <lforsch...@apple.com>
+
+ Merged 93048
+
+ 2011-08-15 Gavin Barraclough <barraclo...@apple.com>
+
+ Crash accessing static property on sealed object
+ https://bugs.webkit.org/show_bug.cgi?id=66242
+
+ Reviewed by Sam Weinig.
+
+ * fast/js/preventExtensions-expected.txt:
+ * fast/js/script-tests/preventExtensions.js:
+ - added test case.
+
2011-08-11 Lucas Forschler <lforsch...@apple.com>
Merged 92692
Modified: branches/safari-534.51-branch/LayoutTests/fast/js/preventExtensions-expected.txt (93141 => 93142)
--- branches/safari-534.51-branch/LayoutTests/fast/js/preventExtensions-expected.txt 2011-08-16 19:34:30 UTC (rev 93141)
+++ branches/safari-534.51-branch/LayoutTests/fast/js/preventExtensions-expected.txt 2011-08-16 19:40:10 UTC (rev 93142)
@@ -10,6 +10,7 @@
PASS test(preventExtensions(obj())) is "(b:4)"
PASS test(seal(obj())) is "(a:1)(b:4)S"
PASS test(freeze(obj())) is "(a:1)(b:2)SF"
+PASS Object.preventExtensions(Math); Math.sqrt(4) is 2
PASS successfullyParsed is true
TEST COMPLETE
Modified: branches/safari-534.51-branch/LayoutTests/fast/js/script-tests/preventExtensions.js (93141 => 93142)
--- branches/safari-534.51-branch/LayoutTests/fast/js/script-tests/preventExtensions.js 2011-08-16 19:34:30 UTC (rev 93141)
+++ branches/safari-534.51-branch/LayoutTests/fast/js/script-tests/preventExtensions.js 2011-08-16 19:40:10 UTC (rev 93142)
@@ -65,4 +65,7 @@
shouldBe('test(seal(obj()))', '"(a:1)(b:4)S"'); // sealed, CANNOT delete a, can modify b, and CANNOT add c
shouldBe('test(freeze(obj()))', '"(a:1)(b:2)SF"'); // sealed and frozen, CANNOT delete a, CANNOT modify b, and CANNOT add c
+// check that we can still access static properties on an object after calling preventExtensions.
+shouldBe('Object.preventExtensions(Math); Math.sqrt(4)', '2');
+
successfullyParsed = true;
\ No newline at end of file
Modified: branches/safari-534.51-branch/Source/_javascript_Core/ChangeLog (93141 => 93142)
--- branches/safari-534.51-branch/Source/_javascript_Core/ChangeLog 2011-08-16 19:34:30 UTC (rev 93141)
+++ branches/safari-534.51-branch/Source/_javascript_Core/ChangeLog 2011-08-16 19:40:10 UTC (rev 93142)
@@ -1,5 +1,20 @@
2011-08-16 Lucas Forschler <lforsch...@apple.com>
+ Merged 93048
+
+ 2011-08-15 Gavin Barraclough <barraclo...@apple.com>
+
+ Crash accessing static property on sealed object
+ https://bugs.webkit.org/show_bug.cgi?id=66242
+
+ Reviewed by Sam Weinig.
+
+ * runtime/JSObject.h:
+ (JSC::JSObject::putDirectInternal):
+ - should only check isExtensible if checkReadOnly.
+
+2011-08-16 Lucas Forschler <lforsch...@apple.com>
+
Merged 88444
2011-06-08 Mikołaj Małecki <m.male...@samsung.com>
Modified: branches/safari-534.51-branch/Source/_javascript_Core/runtime/JSObject.h (93141 => 93142)
--- branches/safari-534.51-branch/Source/_javascript_Core/runtime/JSObject.h 2011-08-16 19:34:30 UTC (rev 93141)
+++ branches/safari-534.51-branch/Source/_javascript_Core/runtime/JSObject.h 2011-08-16 19:40:10 UTC (rev 93142)
@@ -633,7 +633,7 @@
return true;
}
- if (!isExtensible())
+ if (checkReadOnly && !isExtensible())
return false;
size_t currentCapacity = m_structure->propertyStorageCapacity();
@@ -697,7 +697,7 @@
return true;
}
- if (!isExtensible())
+ if (checkReadOnly && !isExtensible())
return false;
Structure* structure = Structure::addPropertyTransition(globalData, m_structure.get(), propertyName, attributes, specificFunction, offset);
