Adds test for newly reported defineProperty bug with old repair.

https://code.google.com/p/chromium/issues/detail?id=374327
https://gist.github.com/getify/22ac00ba029e707f19f5
demonstrate that setting a function's prototype with defineProperty
updates its descriptor but not its actual value.

[MarkM, 2014-05-18 16:37:56]

https://code.google.com/p/chromium/issues/detail?id=374327
https://gist.github.com/getify/22ac00ba029e707f19f5
demonstrate that setting a function's prototype with defineProperty
updates its descriptor but not its actual value.

[MarkM, 2014-05-18 17:29:33]

https://code.google.com/p/chromium/issues/detail?id=374327
https://gist.github.com/getify/22ac00ba029e707f19f5
demonstrate that setting a function's prototype with defineProperty
updates its descriptor but not its actual value.

[kpreid_google, 2014-05-19 16:40:59]

LGTM

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
File src/com/google/caja/ses/repairES5.js (right):

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2716: function bar(){}
space after )

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2717:
Object.defineProperty(bar,'prototype',{value:2,writable:false});
space after , and :

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2725: } else if (typeof bar.prototype ===
'object') {
How about saving the original bar.prototype and comparing with it here? This
makes a stricter new-symptom check and clarifies what the bug is.

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2763: logger.warn('prototype fixup failed',
err);
Curiosity: how is it safe for this to be nonfatal?

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:4429: id:
'DEFINE_PROPERTY_CONFUSES_FUNC_PROTO',
How about putting this problem next to the other ones that use
repair_DEFINE_PROPERTY rather than at the end?

[MarkM, 2014-05-19 18:15:01]

https://code.google.com/p/chromium/issues/detail?id=374327
https://gist.github.com/getify/22ac00ba029e707f19f5
demonstrate that setting a function's prototype with defineProperty
updates its descriptor but not its actual value.

[MarkM, 2014-05-19 18:15:20]

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
File src/com/google/caja/ses/repairES5.js (right):

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2716: function bar(){}
On 2014/05/19 16:40:59, kpreid_google wrote:
> space after )

Done.

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2717:
Object.defineProperty(bar,'prototype',{value:2,writable:false});
On 2014/05/19 16:40:59, kpreid_google wrote:
> space after , and :

Done.

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2725: } else if (typeof bar.prototype ===
'object') {
On 2014/05/19 16:40:59, kpreid_google wrote:
> How about saving the original bar.prototype and comparing with it here? This
> makes a stricter new-symptom check and clarifies what the bug is.

Done.

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:2763: logger.warn('prototype fixup failed',
err);
On 2014/05/19 16:40:59, kpreid_google wrote:
> Curiosity: how is it safe for this to be nonfatal?

Done. I now rethrow the err.

https://codereview.appspot.com/96420043/diff/40001/src/com/google/caja/ses/re...
src/com/google/caja/ses/repairES5.js:4429: id:
'DEFINE_PROPERTY_CONFUSES_FUNC_PROTO',
On 2014/05/19 16:40:59, kpreid_google wrote:
> How about putting this problem next to the other ones that use
> repair_DEFINE_PROPERTY rather than at the end?

Done.