Fixes bug in Object.freeze and Object.seal causing them to misbehave when Array.proto...
authorricow@chromium.org <ricow@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 26 Aug 2010 08:35:49 +0000 (08:35 +0000)
committerricow@chromium.org <ricow@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 26 Aug 2010 08:35:49 +0000 (08:35 +0000)
commit7672338bc9ca54d7f9da735b5c6d67a29dc76c3d
treeffc1b8eab618fa46d548f1968dadd5b100bd437a
parent9f65b1e32dda80646625557b4b6372120389dc67
Fixes bug in Object.freeze and Object.seal causing them to misbehave when Array.prototype has changed.

Object.freeze and Object.seal uses GetOwnPropertyNames which
returns an array with local property names. This array will also have
the additional properties defined on Array.prototype or
Object.prototype.

Note that, the implementation of GetOwnPropertyNames (when used as
Object.getOwnPropertyNames) is correct, since the spec says to create
a new Array (which would also have these properties).

Review URL: http://codereview.chromium.org/3137041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/v8natives.js
test/mjsunit/regress/regress-842.js [new file with mode: 0644]