Revert revision 7143, this causes a number of webkit tests to fail.

This includes a security test. Reverting to investigate further.

Review URL: http://codereview.chromium.org/6673019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/v8natives.js

@@ -251,11 +251,7 @@ function ObjectDefineGetter(name, fun) {
   if (!IS_FUNCTION(fun)) {
     throw new $TypeError('Object.prototype.__defineGetter__: Expecting function');
   }
-  var desc = new PropertyDescriptor();
-  desc.setGet(fun);
-  desc.setEnumerable(true);
-  desc.setConfigurable(true);
-  DefineOwnProperty(ToObject(this), ToString(name), desc, true);
+  return %DefineAccessor(ToObject(this), ToString(name), GETTER, fun);
 }
 
 
@@ -275,11 +271,7 @@ function ObjectDefineSetter(name, fun) {
     throw new $TypeError(
         'Object.prototype.__defineSetter__: Expecting function');
   }
-  var desc = new PropertyDescriptor();
-  desc.setSet(fun);
-  desc.setEnumerable(true);
-  desc.setConfigurable(true);
-  DefineOwnProperty(ToObject(this), ToString(name), desc, true);
+  return %DefineAccessor(ToObject(this), ToString(name), SETTER, fun);
 }
 
 
@@ -402,10 +394,6 @@ function PropertyDescriptor() {
   this.hasSetter_ = false;
 }
 
-PropertyDescriptor.prototype.__proto__ = null;
-PropertyDescriptor.prototype.toString = function() {
-  return "[object PropertyDescriptor]";
-};
 
 PropertyDescriptor.prototype.setValue = function(value) {
   this.value_ = value;
@@ -507,7 +495,7 @@ PropertyDescriptor.prototype.hasSetter = function() {
 // property descriptor. For a description of the array layout please
 // see the runtime.cc file.
 function ConvertDescriptorArrayToDescriptor(desc_array) {
-  if (desc_array === false) {
+  if (desc_array == false) {
     throw 'Internal error: invalid desc_array';
   }
 
@@ -566,7 +554,7 @@ function GetOwnProperty(obj, p) {
 function DefineOwnProperty(obj, p, desc, should_throw) {
   var current_or_access = %GetOwnProperty(ToObject(obj), ToString(p));
   // A false value here means that access checks failed.
-  if (current_or_access === false) return void 0;
+  if (current_or_access == false) return void 0;
 
   var current = ConvertDescriptorArrayToDescriptor(current_or_access);
   var extensible = %IsExtensible(ToObject(obj));

test/mjsunit/accessors-on-global-object.js

@@ -28,7 +28,7 @@
 // Test that installing a getter on the global object instead of a
 // normal property works.
 
-x = 0;
+var x = 0;
 
 function getX() { return x; }
 
@@ -41,7 +41,7 @@ for (var i = 0; i < 10; i++) {
 // Test that installing a setter on the global object instead of a
 // normal property works.
 
-y = 0;
+var y = 0;
 var setter_y;
 
 function setY(value) { y = value; }
@@ -67,6 +67,6 @@ for (var i = 0; i < 10; i++) {
   assertEquals(i < 5 ? 42 : 0, getZ());
   if (i == 4) {
     delete z;
-    z = 0;
+    var z = 0;
   }
 }

test/mjsunit/regress/regress-1240.js

-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// This regression tests that we are not allowed to overwrite an existing
-// non-configurable getter with a new getter. In addition, we should not
-// be able to change the configurable flag from false to true.
-
-var a = {};
-Object.defineProperty(a, 'b',
-                      { get: function () { return 42; }, configurable: false });
-try {
-  a.__defineGetter__('b', function _b(){ return 'foo'; });
-  assertUnreachable();
-} catch (e) {
-  assertTrue(/Cannot redefine property/.test(e));
-}
-assertEquals(42, a.b);
-var desc = Object.getOwnPropertyDescriptor(a, 'b');
-assertFalse(desc.configurable);

test/mozilla/mozilla.status

@@ -745,10 +745,6 @@ js1_5/extensions/regress-342960: FAIL_OK || TIMEOUT if $mode == debug
 # error message in debug mode.
 js1_5/extensions/regress-336410-1: FAIL_OK || TIMEOUT if ($mode == debug && $arch == x64)
 
-# These tests also fails in firefox 4 beta and is disabled in the firefox
-# test manifest.
-js1_5/extensions/regress-313500: FAIL_OK
-js1_5/extensions/regress-325269: FAIL_OK
 
 
 ##################### DECOMPILATION TESTS #####################