Make the 'name' property on error prototypes read-only and dont-delete...

test/mjsunit/error-constructors.js

Index: test/mjsunit/error-constructors.js
===================================================================
--- test/mjsunit/error-constructors.js	(revision 6298)
+++ test/mjsunit/error-constructors.js	(working copy)
@@ -48,4 +48,13 @@
 assertTrue(e0.hasOwnProperty('arguments'));
 assertTrue(e1.hasOwnProperty('arguments'));
 
+// Check that the name property on error prototypes is read-only and
+// dont-delete. This is not specified, but allowing overwriting the
+// name property with a getter can leaks error objects from different
+// script tags in the same context in a browser setting. We therefore
+// disallow changes to the name property on error objects.
+assertEquals("ReferenceError", ReferenceError.prototype.name);
+delete ReferenceError.prototype.name;

[Søren Thygesen Gjesse, 2011/01/14 12:47:26]

add
assertEquals("ReferenceError", ReferenceError.prototype.name);

just after delete as well?

+ReferenceError.prototype.name = "not a reference error";
+assertEquals("ReferenceError", ReferenceError.prototype.name);