Summary: | REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Khoo Yit Phang <khooyp> | ||||||||||
Component: | JavaScriptCore | Assignee: | Darin Adler <darin> | ||||||||||
Status: | RESOLVED FIXED | ||||||||||||
Severity: | Normal | CC: | darin, mrowe | ||||||||||
Priority: | P1 | Keywords: | HasReduction, Regression | ||||||||||
Version: | 528+ (Nightly build) | ||||||||||||
Hardware: | Mac | ||||||||||||
OS: | OS X 10.4 | ||||||||||||
Attachments: |
|
Description
Khoo Yit Phang
2007-11-09 15:32:51 PST
Created attachment 17163 [details]
Test case
Created attachment 17169 [details]
Working test case
The test case provided throws a JavaScript exception. I've attached a fixed version that demonstrates the issue.
This is a regression from WebKit in Leopard. "git bisect" narrowed this down to regressing in r27487 (http://trac.webkit.org/projects/webkit/changeset/27487). Running with hashtable consistency checks on does not turn up anything useful. CC'ing Darin as he was responsible for the change that introduced this regression. Created attachment 17171 [details]
Test case in a testkjs-friendly form
This is the same test case in a testkjs-friendly form. It also prints out a handy SUCCESS or FAIL at the end.
Created attachment 17173 [details]
patch
Comment on attachment 17173 [details]
patch
r=me. Are we considering 4k large these days?
Committed revision 27678. |