Bug 113353 – REGRESSION: Sometimes, operations on proven strings ignore changes to the string prototype

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

Here's the test case:

function foo() {
    return String(this);
}

for (var i = 0; i < 100; ++i) {
    if (i == 99)
        String.prototype.toString = function() { return 42; }
    print(foo.call(new String("foo")));
}

<rdar://problem/13510778>

[Filip Pizlo]

Created attachment 195187 [details]
the patch

[Filip Pizlo]

Created attachment 195188 [details]
the patch

[Filip Pizlo]

Created attachment 195190 [details]
the patch

[WebKit Review Bot]

Attachment 195190 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast/js/dfg-phantom-base-expected.txt', u'LayoutTests/fast/js/dfg-phantom-base.html', u'LayoutTests/fast/js/dfg-to-string-toString-becomes-bad-with-check-structure-expected.txt', u'LayoutTests/fast/js/dfg-to-string-toString-becomes-bad-with-check-structure.html', u'LayoutTests/fast/js/jsc-test-list', u'LayoutTests/fast/js/script-tests/dfg-phantom-base.js', u'LayoutTests/fast/js/script-tests/dfg-to-string-toString-becomes-bad-with-check-structure.js', u'Source/JavaScriptCore/ChangeLog', u'Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp', u'Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h']" exit_code: 1
LayoutTests/ChangeLog:9:  Need whitespace between colon and description  [changelog/filechangedescriptionwhitespace] [5]
Total errors found: 1 in 11 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Geoffrey Garen]

Comment on attachment 195190 [details]
the patch

r=me

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/146947