Bug 154416 – JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Gavin Barraclough]

Here's the bug. Suppose you call JSObject::getOwnProperty and:
 * PropertyName contains an index
 * An object on the prototype chain overrides getOwnPropertySlot, and has that index property
 * The base of the access (or another object on the prototype chain) shadows that property

JSObject::getPropertySlot is written assuming the common case is that propertyName is not an
index, and as such walks up the prototype chain looking for non-index properties before it
tries calling parseIndex.

At the point we reach an object on the prototype chain overriding getOwnPropertySlot (which
would potentially return the property) we may have already skipped over non-overriding
objects that contain the property in index storage.

[Gavin Barraclough]

Created attachment 271696 [details]
Fix

[Gavin Barraclough]

Created attachment 271697 [details]
Fix

[WebKit Commit Bot]

Attachment 271697 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/ChangeLog:9:  Need whitespace between colon and description  [changelog/filechangedescriptionwhitespace] [5]
ERROR: Source/JavaScriptCore/ChangeLog:10:  Need whitespace between colon and description  [changelog/filechangedescriptionwhitespace] [5]
ERROR: Source/JavaScriptCore/ChangeLog:11:  Need whitespace between colon and description  [changelog/filechangedescriptionwhitespace] [5]
ERROR: Source/JavaScriptCore/runtime/JSObject.h:861:  The parameter name "propertyName" adds no information, so it should be removed.  [readability/parameter_name] [5]
Total errors found: 4 in 8 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Build Bot]

Comment on attachment 271697 [details]
Fix

Attachment 271697 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/851606

New failing tests:
streams/reference-implementation/abstract-ops.html

[Build Bot]

Created attachment 271704 [details]
Archive of layout-test-results from ews101 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews101  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 271697 [details]
Fix

Attachment 271697 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/851608

New failing tests:
streams/reference-implementation/abstract-ops.html

[Build Bot]

Created attachment 271706 [details]
Archive of layout-test-results from ews105 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 271697 [details]
Fix

Attachment 271697 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/851626

New failing tests:
streams/reference-implementation/abstract-ops.html

[Build Bot]

Created attachment 271708 [details]
Archive of layout-test-results from ews113 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews113  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Gavin Barraclough]

Created attachment 271766 [details]
Fix

[Build Bot]

Comment on attachment 271766 [details]
Fix

Attachment 271766 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/855539

Number of test failures exceeded the failure limit.

[Build Bot]

Created attachment 271774 [details]
Archive of layout-test-results from ews107 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 271766 [details]
Fix

Attachment 271766 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/855552

Number of test failures exceeded the failure limit.

[Build Bot]

Created attachment 271775 [details]
Archive of layout-test-results from ews103 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews103  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 271766 [details]
Fix

Attachment 271766 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/855569

Number of test failures exceeded the failure limit.

[Build Bot]

Created attachment 271777 [details]
Archive of layout-test-results from ews116 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews116  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Gavin Barraclough]

Created attachment 271819 [details]
Fix

[Geoffrey Garen]

Comment on attachment 271819 [details]
Fix

r=me

[Gavin Barraclough]

Committed revision 196849.