Changeset 210457 in webkit for trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp

Timestamp:

Jan 6, 2017, 3:30:57 PM (8 years ago)

Author:

[email protected]

Message:

@putByValDirect in Array.of and Array.from overwrites non-writable/configurable properties
​https://bugs.webkit.org/show_bug.cgi?id=153486

Reviewed by Saam Barati.

JSTests:

New regression test.

• stress/regress-153486.js: Added.

(shouldEqual):
(makeUnwriteableUnconfigurableObject):
(testArrayOf):
(testArrayFrom):
(runTest):

Source/JavaScriptCore:

Moved read only check in putDirect() to all paths.

• runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayValueMap::putDirect):

File:

• trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp

@@ -138 +138 @@
     SparseArrayEntry& entry = result.iterator->value;
 
-    if (mode != PutDirectIndexLikePutDirect && !array->isStructureExtensible()) {
-        // To save a separate find & add, we first always add to the sparse map.
-        // In the uncommon case that this is a new property, and the array is not
-        // extensible, this is not the right thing to have done - so remove again.
-        if (result.isNewEntry) {
-            remove(result.iterator);
-            return typeError(exec, scope, shouldThrow, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
-        }
-        if (entry.attributes & ReadOnly)
-            return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
-    }
+    // To save a separate find & add, we first always add to the sparse map.
+    // In the uncommon case that this is a new property, and the array is not
+    // extensible, this is not the right thing to have done - so remove again.
+    if (mode != PutDirectIndexLikePutDirect && result.isNewEntry && !array->isStructureExtensible()) {
+        remove(result.iterator);
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
+    }
+
+    if (entry.attributes & ReadOnly)
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
     entry.attributes = attributes;
     entry.set(vm, this, value);