Where in spec does it explain why setting the value of an existing property will change its [[Enumerable]] attribute.

Andreas Rossberg rossberg at google.com
Thu Aug 18 04:02:40 PDT 2011


On 17 August 2011 21:24, John-David Dalton <john.david.dalton at gmail.com> wrote:
> Another odd thing is that V8 uses the `Array#push` internally for
> `Object.defineProperties`.
> I noticed that if I set `Array.prototype.push = 1;` using
> `Object.defineProperties(…)` would error complaining about `push` not
> being a function.

Yes, there are still several bugs like that in the V8 built-ins. The
reason is that most of these built-ins are written in JS itself, and
in some places the code isn't careful enough about applying the
original function instead of just invoking an object method.

/Andreas


More information about the es-discuss mailing list