Last Comment Bug 588138 - Object.defineProperty() allows to overwrite frozen Object properties
: Object.defineProperty() allows to overwrite frozen Object properties
Status: RESOLVED WORKSFORME
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86 All
: -- normal (vote)
: ---
Assigned To: Nobody; OK to take it and work on it
:
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-17 12:22 PDT by Mario Heiderich
Modified: 2015-01-27 13:09 PST (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Mario Heiderich 2010-08-17 12:22:55 PDT
User-Agent:       Mozilla/5.0 (X11; Linux i686; rv:2.0b4pre) Gecko/20100816 Minefield/4.0b4pre
Build Identifier: 

Object.defineProperty() allows to overwrite frozen Object properties - which should not be possible. Example 

{{{
Object.defineProperty(window, 'alert', {value:prompt,configurable:false});
alert(1);
Object.defineProperty(window, 'alert', {value:confirm,configurable:false});
alert(1);
}}}

Reproducible: Always

Steps to Reproduce:
1. Execute the example code

Actual Results:  
the first alert(1) will execute prompt(1) - the second alert(1) will execute confirm(1)

Expected Results:  
Both alerts should execute prompt(1)
Comment 1 Mario Heiderich 2010-08-17 12:24:02 PDT
Tested on: Mozilla/5.0 (X11; Linux i686; rv:2.0b4pre) Gecko/20100816 Minefield/4.0b4pre
Comment 2 Blake Kaplan (:mrbkap) 2010-08-17 13:57:18 PDT
This appears to be a browser-only.

Note You need to log in before you can comment on or make changes to this bug.