Bug 15927 – REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Khoo Yit Phang]

When a property is deleted, and a getter/setter of the same name is create, another unrelated property will be deleted as well:

    var obj = { a:1, b:2, c:3, d:4, e:5 }
    delete obj.c;
    obj.__defineGetter__("c", function() { return 3 });
    /* obj.e will be deleted!*/

My testing seems to indicate that the latest-defined property is the one that gets deleted; mistakenly replaced by the getter/setter perhaps?

[Khoo Yit Phang]

Created attachment 17163 [details]
Test case

[Mark Rowe (bdash)]

Created attachment 17169 [details]
Working test case

The test case provided throws a JavaScript exception.  I've attached a fixed version that demonstrates the issue.

[Mark Rowe (bdash)]

This is a regression from WebKit in Leopard.

[Mark Rowe (bdash)]

"git bisect" narrowed this down to regressing in r27487 (http://trac.webkit.org/projects/webkit/changeset/27487).  Running with hashtable consistency checks on does not turn up anything useful.

CC'ing Darin as he was responsible for the change that introduced this regression.

[Mark Rowe (bdash)]

Created attachment 17171 [details]
Test case in a testkjs-friendly form

This is the same test case in a testkjs-friendly form.  It also prints out a handy SUCCESS or FAIL at the end.

[Darin Adler]

Created attachment 17173 [details]
patch

[Sam Weinig]

Comment on attachment 17173 [details]
patch

r=me.  Are we considering 4k large these days?

[Darin Adler]

Committed revision 27678.