From d0fe04447e8dfd9ae8df6d586e23d2a391a7d6a4 Mon Sep 17 00:00:00 2001
From: "svenpanne@chromium.org"
 <svenpanne@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Wed, 19 Oct 2011 09:52:08 +0000
Subject: [PATCH] Fixed evaluation order issue in defineProperties.

This is not covered by test262 yet, but it really makes sense and matches Firefox's behaviour.

TEST=mjsunit/define-properties.js
Review URL: http://codereview.chromium.org/8349031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/v8natives.js                         |  8 +++++---
 test/mjsunit/object-define-properties.js | 16 ++++++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/v8natives.js b/src/v8natives.js
index 337349c..ec5407d 100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -1078,10 +1078,12 @@ function ObjectDefineProperties(obj, properties) {
     throw MakeTypeError("obj_ctor_property_non_object", ["defineProperties"]);
   var props = ToObject(properties);
   var names = GetOwnEnumerablePropertyNames(props);
+  var descriptors = new InternalArray();
   for (var i = 0; i < names.length; i++) {
-    var name = names[i];
-    var desc = ToPropertyDescriptor(props[name]);
-    DefineOwnProperty(obj, name, desc, true);
+    descriptors.push(ToPropertyDescriptor(props[names[i]]));
+  }
+  for (var i = 0; i < names.length; i++) {
+    DefineOwnProperty(obj, names[i], descriptors[i], true);
   }
   return obj;
 }
diff --git a/test/mjsunit/object-define-properties.js b/test/mjsunit/object-define-properties.js
index 128df69..6d5032e 100644
--- a/test/mjsunit/object-define-properties.js
+++ b/test/mjsunit/object-define-properties.js
@@ -54,3 +54,19 @@ var x = Object.defineProperties(obj, desc);
 
 assertEquals(x.foo, 10);
 assertEquals(x.bar, 42);
+
+
+// Make sure that all property descriptors are calculated before any
+// modifications are done.
+
+var object = {};
+
+assertThrows(function() {
+    Object.defineProperties(object, {
+      foo: { value: 1 },
+      bar: { value: 2, get: function() { return 3; } }
+    });
+  }, TypeError);
+
+assertEquals(undefined, object.foo);
+assertEquals(undefined, object.bar);
-- 
2.7.4