[].push wrt properties along the [[Prototype]] chain

[Kevin Reid]

On Fri, Feb 15, 2013 at 5:30 PM, Jeff Walden <jwalden+es at mit.edu> wrote:

> Consider:
>
>   Object.defineProperty(Object.prototype, "0", { value: 17, writable:
> false, configurable: false });
>   [].push(42);
>
> Per ES5, I think this is supposed to throw a TypeError.  The push should
> be setting property "0" with Throw = true, which means that when [[CanPut]]
> fails, a TypeError gets thrown.  No engine I can test does this, I suspect
> because everyone's mis-implemented an optimization.


FYI, this looks very similar to <
http://code.google.com/p/v8/issues/detail?id=2412>, which is one of the
bugs which SES/Caja is concerned about: Array.prototype.push can mutate a
sealed (but not frozen) object.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20130219/0ed1bf6d/attachment.html>