Fix bug 344: always keep attributes of existing properties.

Review URL: http://codereview.chromium.org/113197

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index 0a8ee83..6716415 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1736,8 +1736,10 @@ Object* JSObject::SetProperty(LookupResult* result,
       }
       return ConvertDescriptorToField(name, value, attributes);
     case CONSTANT_FUNCTION:
-      if (value == result->GetConstantFunction()) return value;
       // Only replace the function if necessary.
+      if (value == result->GetConstantFunction()) return value;
+      // Preserve the attributes of this existing property.
+      attributes = result->GetAttributes();
       return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
     case CALLBACKS:
       return SetPropertyWithCallback(result->GetCallbackObject(),
@@ -1817,8 +1819,10 @@ Object* JSObject::IgnoreAttributesAndSetLocalProperty(
       }
       return ConvertDescriptorToField(name, value, attributes);
     case CONSTANT_FUNCTION:
-      if (value == result->GetConstantFunction()) return value;
       // Only replace the function if necessary.
+      if (value == result->GetConstantFunction()) return value;
+      // Preserve the attributes of this existing property.
+      attributes = result->GetAttributes();
       return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
     case CALLBACKS:
     case INTERCEPTOR:

diff --git a/test/mjsunit/bugs/bug-334.js b/test/mjsunit/regress/regress-334.js
similarity index 100%
rename from test/mjsunit/bugs/bug-334.js
rename to test/mjsunit/regress/regress-334.js