Fixes issue 712 causing non-configurable accessors to be overwritable by usin...

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 544 matching lines @@
   return %NumberToJSInt32(ToNumber(x));
 }
 
 
 // ES5, section 9.12
 function SameValue(x, y) {
   if (typeof x != typeof y) return false;
   if (IS_NULL_OR_UNDEFINED(x)) return true;
   if (IS_NUMBER(x)) {
     if (NUMBER_IS_NAN(x) && NUMBER_IS_NAN(y)) return true;
-    // x is +0 and y is -0 or vice versa
-    if (x === 0 && y === 0 && !%_IsSmi(x) && !%_IsSmi(y) &&
-        ((1 / x < 0 && 1 / y > 0) || (1 / x > 0 && 1 / y < 0))) {
+    // x is +0 and y is -0 or vice versa.
+    if (x === 0 && y === 0 && (1 / x) != (1 / y)) {
       return false;
     }
     return x == y;
   }
   if (IS_STRING(x)) return %StringEquals(x, y);
-  if (IS_BOOLEAN(x))return %NumberEquals(%ToNumber(x),%ToNumber(y));
+  if (IS_BOOLEAN(x)) return y == x;
 
   return %_ObjectEquals(x, y);
 }
 
 
 /* ---------------------------------
    - - -   U t i l i t i e s   - - -
    ---------------------------------
 */
 
@@ skipping 41 matching lines @@
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essiential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));