731a370b1f
According to the spec, in case where the property is non-configurable and non-writable, the value passed to the set trap should be compared to the data. Instead, the trap result was compared, because of the misleading name of the CheckGetSetTrapResult parameter. Regression was introduced in https://chromium-review.googlesource.com/c/v8/v8/+/1604071 Bug: chromium:966450 Change-Id: I77501980475da3aeb4f6153321da39e6fc2e6bd9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632238 Auto-Submit: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#61916}
18 lines
474 B
JavaScript
18 lines
474 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
let prop = "someName";
|
|
function foo(a, b, v) { return a[b] = 0 }
|
|
try {
|
|
foo("", prop);
|
|
} catch(e) {}
|
|
var target = {};
|
|
var traps = { set() {return 42} };
|
|
var proxy = new Proxy(target, traps);
|
|
Object.defineProperty(target, prop, { value: 0 });
|
|
try {
|
|
foo(proxy, prop);
|
|
} catch (e) { }
|
|
foo(proxy, prop, 0);
|