Bug 154175 – Fast path in JSObject::defineOwnIndexedProperty() forgets to check for the posibility of a descriptor that doesn’t have a value

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

Patch forthcoming.

[Filip Pizlo]

Created attachment 271190 [details]
the patch

[Geoffrey Garen]

Comment on attachment 271190 [details]
the patch

r=me

[Geoffrey Garen]

I know that there's a large test suite you're working on, which will reveal this bug -- meeting the WebKit requirement for tests with patches. Still, it seems like it would be nice to add a reduced test case here.

[Filip Pizlo]

(In reply to comment #3)
> I know that there's a large test suite you're working on, which will reveal
> this bug -- meeting the WebKit requirement for tests with patches. Still, it
> seems like it would be nice to add a reduced test case here.

I agree - for some reason at first I thought that the test would be hard because of the sparse indexing issue.  It's actually not:

var array = [];
array[10000000] = 42;
Object.defineProperty(array, 10000000, {configurable: true, enumerable: true, writable: true});
var result = array[10000000];
if (result != 42)
    throw "Error: bad result: " + result;

That crashes on trunk.

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/196490