Where in spec does it explain why setting the value of an existing property will change its [[Enumerable]] attribute.

Andreas Rossberg rossberg at google.com
Thu Aug 18 04:02:40 PDT 2011

On 17 August 2011 21:24, John-David Dalton <john.david.dalton at gmail.com> wrote:
> Another odd thing is that V8 uses the `Array#push` internally for
> `Object.defineProperties`.
> I noticed that if I set `Array.prototype.push = 1;` using
> `Object.defineProperties(…)` would error complaining about `push` not
> being a function.

Yes, there are still several bugs like that in the V8 built-ins. The
reason is that most of these built-ins are written in JS itself, and
in some places the code isn't careful enough about applying the
original function instead of just invoking an object method.


More information about the es-discuss mailing list