| Summary: | Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Caitlin Potter (:caitp) <caitp> | ||||
| Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | benjamin, commit-queue, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, rmorisset, saam, ticaiolima, webkit-bug-importer, ysuzuki | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
It turns out that not only is this not needed, this weird behavior is causing observable side effects. Created attachment 329211 [details]
patch
There's a chance I need to update test262 test expectations. Comment on attachment 329211 [details]
patch
r=me
Comment on attachment 329211 [details] patch Clearing flags on attachment: 329211 Committed r225845: <https://trac.webkit.org/changeset/225845> All reviewed patches have been landed. Closing bug. 👏🙌 *** Bug 157461 has been marked as a duplicate of this bug. *** |
The following code in Source/JavaScriptCore/runtime/JSFunction.cpp, added in 2011, could use some investigation/auditing: ``` // This will trigger the property to be reified, if this is not already the case! bool okay = thisObject->hasProperty(exec, propertyName); ASSERT_UNUSED(okay, okay); scope.release(); return Base::put(thisObject, exec, propertyName, value, slot); ``` It's unclear what the purpose of reifying this is, as the properties in question are not lazy. Base::put() ought to be enough.