230150 2021-09-10 06:43:25 -0700 [JSC][32bit] in-by-val fails inside for-in loop after delete 2021-09-13 10:38:21 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 xan.lopez webkit-unassigned cgarcia ews-watchlist keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer xan.lopez oldest_to_newest 1792317 0 xan.lopez 2021-09-10 06:43:25 -0700 Test: function test2() { let o = { a:20, b:30, c:40, d:50 }; for (let p in o) { delete o[p]; if (p in o) print("wtf"); } } for (let i = 0; i < 1000; i++) test2(); Execution: xlopez@bbox-11-armhf:~/WebKit$ ./WebKitBuild/Debug/bin/jsc -f ../js/in-by-test.js Exception: TypeError: o is not an Object. (evaluating 'p in o') test2@../js/in-by-test.js:11:18 global code@../js/in-by-test.js:16:10 I believe this is fallout from https://commits.webkit.org/r280760, can be reproduced easily in ToT after the WIP patch in bug #229543 is applied. 1792904 1 438025 xan.lopez 2021-09-13 03:04:21 -0700 Created attachment 438025 v1 This was a very silly mistake in the end. 1792997 2 ews-feeder 2021-09-13 10:37:09 -0700 Committed r282336 (241603@main): <https://commits.webkit.org/241603@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 438025. 1792998 3 webkit-bug-importer 2021-09-13 10:38:21 -0700 <rdar://problem/83062246> 438025 2021-09-13 03:04:21 -0700 2021-09-13 10:37:11 -0700 v1 0001-JSC-32bit-in-by-val-fails-inside-for-in-loop-after-d.patch text/plain 2125 xan.lopez RnJvbSA3YTlmMjQ1ODI0NTkxNWRjMzkzZTM3YWVhYjEyZTRkYWY5ZTFjMzU5IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/WGFuPTIwTD1DMz1CM3Blej89IDx4YW5AaWdh bGlhLmNvbT4KRGF0ZTogTW9uLCAxMyBTZXAgMjAyMSAxMTo1MToxMiArMDIwMApTdWJqZWN0OiBb UEFUQ0hdIFtKU0NdWzMyYml0XSBpbi1ieS12YWwgZmFpbHMgaW5zaWRlIGZvci1pbiBsb29wIGFm dGVyIGRlbGV0ZQogaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzMDE1 MAoKUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCgpUaGUgb3JkZXIgb2YgcGF5bG9hZCBhbmQg dGFnIHdhcyByZXZlcnNlZCB3aGVuIGNvbnN0cnVjdGluZyB0aGUKYmFzZSB2YWx1ZSBmb3IgY29t cGlsZUVudW1lcmF0b3JIYXNQcm9wZXJ0eS4KCiogZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcDoK KEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZUVudW1lcmF0b3JIYXNQcm9wZXJ0eSk6 Ci0tLQogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgfCAx MyArKysrKysrKysrKysrCiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZl SklULmNwcCB8ICAyICstCiAyIGZpbGVzIGNoYW5nZWQsIDE0IGluc2VydGlvbnMoKyksIDEgZGVs ZXRpb24oLSkKCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nIGIv U291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAzZjc1NzUyYjkxYzcuLjcwMTEw Yzg3ZDJlZiAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZworKysg Yi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMjEt MDktMTMgIFhhbiBMw7NwZXogIDx4YW5AaWdhbGlhLmNvbT4KKworICAgICAgICBbSlNDXVszMmJp dF0gaW4tYnktdmFsIGZhaWxzIGluc2lkZSBmb3ItaW4gbG9vcCBhZnRlciBkZWxldGUKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzMDE1MAorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBvcmRlciBvZiBw YXlsb2FkIGFuZCB0YWcgd2FzIHJldmVyc2VkIHdoZW4gY29uc3RydWN0aW5nIHRoZQorICAgICAg ICBiYXNlIHZhbHVlIGZvciBjb21waWxlRW51bWVyYXRvckhhc1Byb3BlcnR5LgorCisgICAgICAg ICogZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpTcGVjdWxh dGl2ZUpJVDo6Y29tcGlsZUVudW1lcmF0b3JIYXNQcm9wZXJ0eSk6CisKIDIwMjEtMDktMTEgIFhh biBMw7NwZXogIDx4YW5AaWdhbGlhLmNvbT4KIAogICAgICAgICBbSlNDXSBBU1NFUlQgZmFpbGVk IGluIHN0cmVzcy9mb3ItaW4tdGVzdHMuanMgKDMyYml0KQpkaWZmIC0tZ2l0IGEvU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcAppbmRleCA4ZTQ4ZGQzYWM3NzAuLjJmYzMw Yzk5ZDg4YyAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxh dGl2ZUpJVC5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2 ZUpJVC5jcHAKQEAgLTEzNzI1LDcgKzEzNzI1LDcgQEAgdm9pZCBTcGVjdWxhdGl2ZUpJVDo6Y29t cGlsZUVudW1lcmF0b3JIYXNQcm9wZXJ0eShOb2RlKiBub2RlLCBTbG93UGF0aEZ1bmN0aW9uVHkK IAogI2lmIFVTRShKU1ZBTFVFMzJfNjQpCiAgICAgICAgIG1faml0Lm1vdmUoVHJ1c3RlZEltbTMy KEpTVmFsdWU6OkNlbGxUYWcpLCByZXN1bHRSZWdzLnRhZ0dQUigpKTsKLSAgICAgICAgYXV0byBi YXNlUmVncyA9IEpTVmFsdWVSZWdzKGJhc2VDZWxsR1BSLCByZXN1bHRSZWdzLnRhZ0dQUigpKTsK KyAgICAgICAgYXV0byBiYXNlUmVncyA9IEpTVmFsdWVSZWdzKHJlc3VsdFJlZ3MudGFnR1BSKCks IGJhc2VDZWxsR1BSKTsKICNlbHNlCiAgICAgICAgIGF1dG8gYmFzZVJlZ3MgPSBiYXNlOwogI2Vu ZGlmCi0tIAoyLjMxLjEKCg==