Bug 15927

Summary: REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property
Product: WebKit Reporter: Khoo Yit Phang <khooyp>
Component: JavaScriptCoreAssignee: Darin Adler <darin>
Severity: Normal CC: darin, mrowe
Priority: P1 Keywords: HasReduction, Regression
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.4   
Description Flags
Test case
Working test case
Test case in a testkjs-friendly form
patch sam: review+

Description Khoo Yit Phang 2007-11-09 15:32:51 PST
When a property is deleted, and a getter/setter of the same name is create, another unrelated property will be deleted as well:

    var obj = { a:1, b:2, c:3, d:4, e:5 }
    delete obj.c;
    obj.__defineGetter__("c", function() { return 3 });
    /* obj.e will be deleted!*/

My testing seems to indicate that the latest-defined property is the one that gets deleted; mistakenly replaced by the getter/setter perhaps?
Comment 1 Khoo Yit Phang 2007-11-09 15:34:21 PST
Created attachment 17163 [details]
Test case
Comment 2 Mark Rowe (bdash) 2007-11-10 03:55:28 PST
Created attachment 17169 [details]
Working test case

The test case provided throws a JavaScript exception.  I've attached a fixed version that demonstrates the issue.
Comment 3 Mark Rowe (bdash) 2007-11-10 03:56:11 PST
This is a regression from WebKit in Leopard.
Comment 4 Mark Rowe (bdash) 2007-11-10 04:42:20 PST
"git bisect" narrowed this down to regressing in r27487 (http://trac.webkit.org/projects/webkit/changeset/27487).  Running with hashtable consistency checks on does not turn up anything useful.

CC'ing Darin as he was responsible for the change that introduced this regression.
Comment 5 Mark Rowe (bdash) 2007-11-10 04:43:40 PST
Created attachment 17171 [details]
Test case in a testkjs-friendly form

This is the same test case in a testkjs-friendly form.  It also prints out a handy SUCCESS or FAIL at the end.
Comment 6 Darin Adler 2007-11-10 12:14:20 PST
Created attachment 17173 [details]
Comment 7 Sam Weinig 2007-11-10 16:11:10 PST
Comment on attachment 17173 [details]

r=me.  Are we considering 4k large these days?
Comment 8 Darin Adler 2007-11-10 17:10:44 PST
Committed revision 27678.